Microsoft Just Published the Vish Chain We Warned Medtronic About
- Patrick Duggan
- 4 minutes ago
- 4 min read
May 3, 2026 · DugganUSA LLC
Microsoft Security today published "Cross-tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook." It is, line by line, the attack chain we documented in our outreach to Medtronic's Product Security team on March 19, 2026. Six weeks before Medtronic confirmed the breach. Our outreach went to [email protected] and got an autoresponder from [email protected] confirming delivery. We have the timestamps. We published the chain on April 19. ADT got hit on April 20. Inditex, Kemper, and Amtrek got hit on April 24. Medtronic confirmed April 22.
Microsoft is publishing it today.
A disclaimer up front: we are not in the room
Before we walk through the receipt: DugganUSA was not part of any investigation that produced the Microsoft post, the Mandiant UNC6040 attribution, the Volexity follow-ups, or any of the named-victim incident-response engagements. We have no FBI relationship feeding us early indicators. No vendor partnership with Microsoft or Mandiant. No NDA tip line. No insider pre-disclosure of any kind.
We read public IOCs, we read vendor blogs after they ship, we run our own attack-surface scanner against public DNS data, and we publish what the math says. The prediction we are about to walk through was made entirely from open-source signals — Shodan-reachable subdomains, certificate transparency logs, our own indexed copies of public ShinyHunters infrastructure, and the absence of CVE-patching evidence at named targets. No magic. No insider angle. Just the work, run continuously, against the same public surface every other defender has access to.
We mention this because the receipt below — Microsoft publishing the playbook six weeks after we sent it directly to Medtronic's Product Security team — is the kind of thing that invites the assumption of insider knowledge. There was none. We are just that focused on the math.
The chain — same words, different timestamps
Microsoft, today: voice-call into a corporate helpdesk impersonating an internal employee, request an MFA reset on the employee's identity-provider account, log in, walk into Salesforce, export the customer file as CSV.
DugganUSA, April 19: voice-call into a corporate helpdesk impersonating an internal employee, request an MFA reset on the employee's Okta SSO, log in, walk into Salesforce, export the customer file as CSV.
DugganUSA, March 19 (in the message that hit Medtronic's Product Security inbox and was never opened): "If Handala pivots from Stryker, Medtronic's surface is equivalent."
The pattern is the pattern. Mandiant tracks it under UNC6040. ShinyHunters runs the leak site. The methodology is durable because the vulnerability is human, not technical. Helpdesks resetting MFA without out-of-band verification is the underlying weakness, and that weakness exists at most enterprises with a Salesforce CRM and an Okta-class identity provider and a phone-staffed helpdesk.
That's a category that includes a meaningful fraction of the Fortune 1000.
The lead-time ledger we already published
Five named victims since April 19, with our first indicator stamped before each disclosure date:
ADT Inc. — disclosed April 20. Our first indicator: April 19 ShinyHunters Vercel methodology post. Lead time: +1 day. Ten million records claimed.
Inditex (Zara parent) — disclosed April 24. Same April 19 indicator. Lead time: +5 days. Nine million records.
Kemper Corporation — disclosed April 24. Same April 19 indicator. Lead time: +5 days. Thirteen million records, twenty-nine gigabytes.
Amtrek — disclosed April 24. Same April 19 indicator. Lead time: +5 days. Two point one million records.
Medtronic — disclosed April 22 by Medtronic, claimed by ShinyHunters April 17. Our March 19 outreach went to [email protected] and was not engaged. Lead time on the methodology: +29 days. Approximately nine million records claimed.
Microsoft is the eighth or ninth voice in the room confirming what was on our blog and in our STIX feed three to six weeks before each named disclosure. The receipts are timestamped, the indicators are queryable, the lead times are computed by subtraction.
What changes now
For the cluster of companies Microsoft just told the rest of the world to worry about, we already wrote the names down. From our March 16 medical-device vertical attack-surface matrix, the rule was: companies with more than two hundred dev-test subdomains have a one hundred percent breach rate in 2026. Stryker hit. Medtronic hit. The next three names on the same chart are Abbott (one hundred dev-test environments, AIPM 31, prior pacemaker breach 2022), Baxter (seventy-five dev-test, AIPM 29, two thousand six hundred Baxter-related IOCs already in our feed), and Philips (fifty-one dev-test, AIPM 31, prior MRI/CT vulnerabilities still in CISA KEV).
If you work at any of them, the AIPM audit takes minutes at aipmsec.com — free for the first audit. The STIX feed is at analytics.dugganusa.com/stix, twenty-five queries a day at the free tier and ninety-nine dollars a month for two thousand. The attack-surface scanner is auth-gated and available on a thirty-minute call.
What changes for everyone else
If you have a Salesforce instance, an Okta-class identity provider, and a help desk that takes phone calls and processes MFA resets, run the tabletop on this attack chain before the call comes in. Microsoft just gave the public version of the playbook. The criminal-cluster running the playbook has hit five named victims in the last three weeks and is not slowing down.
We will keep publishing the predictions. We will keep publishing the receipts. We will publish them in time for someone to act on them, at the price of a vendor sales-deck demo, and we will publish whether the warning landed or did not.
The data was on the wire. It was on our blog. It was in our feed. It was in Medtronic's Product Security inbox six weeks before they confirmed.
The gap between having the warning and acting on it is where nine million records walk out the door.
— Patrick Duggan, DugganUSA LLC. The Microsoft Security post is at microsoft.com/en-us/security/blog. Our left-of-boom ledger is at dugganusa.com. Our STIX feed is at analytics.dugganusa.com/stix.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.