Zero Radar
← feed
MediumData breachHIBP-Medelaupdated 25 Oct 2026, 13:32 UTC

Medela contact data leaked after extortion attack

Hackers stole and published contact details of healthcare workers and Medela staff. Expect spam, phishing emails and fake calls that use your real name and workplace.

Official source
SeverityMediumData breach
Being exploited?UnclearNo reports either way yet
What to doCheck exposureTreat any unexpected message mentioning Medela or your work contact details with suspicion and verify it independently before responding.
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1ShinyHunters groupExtortion campaign against Medela
  2. 2Medela systemsContact and support data taken
  3. 3Data published424k email addresses and records released
  4. 4Targeted phishingScammers use real names and employers
  5. ResultContacts used for phishing and scams

What happened

Swiss medical device company Medela was hit by a ShinyHunters 'pay or leak' extortion campaign in September 2026, and the allegedly stolen data was later published publicly.

Why it is dangerous: About 424k unique email addresses were exposed, mostly of healthcare professionals, Medela staff and leads, along with names, phone numbers, physical addresses, employers, job titles and some support tickets. This data can be used for targeted phishing and scams.

Are you affected?

You are affected if your email address, name, phone number or address was in Medela's customer, lead or support records, which is likely if you are a healthcare professional or Medela staff member or lead.

Package / productAffected versionsFixed in
medela.comsee advisoryno fix yet

What to do

  1. Be wary of unexpected emails, calls or messages referencing Medela, your job or support requests, and verify them through known contacts before acting.
  2. Do not click links or share passwords or payment details based on such messages.
  3. Enable multi-factor authentication on important accounts that use the exposed email address.
  4. Staff at Medela should follow their internal incident response and notification guidance.

Timeline

  1. 30 Sept 2026, 11:48 UTC
    Publicly disclosed
  2. 30 Sept 2026, 11:48 UTC
    Reported by Have I Been Pwned · Have I Been Pwned

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
HIBP-Medela
Disclosed
30 Sept 2026, 11:48 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Medela contact data leaked after extortion attack · Zero Radar