We Predicted Medtronic. The Receipts.
- Patrick Duggan
- 1 minute ago
- 8 min read
Six weeks later, ShinyHunters disclosed 9 million records.
May 2, 2026 · Patrick Duggan, DugganUSA LLC
On April 17, the cybercrime collective ShinyHunters posted on a dark-web forum that they had breached Medtronic and exfiltrated records on roughly nine million people. Five days later, Medtronic confirmed an "unauthorized party" had accessed their corporate IT environment. By April 27, The Register was running a joint write-up about Medtronic and Itron both admitting digital break-ins.
We had already named Medtronic as the highest-risk medical device company in the vertical six weeks earlier.
This post is the receipt.
What we wrote — and when
On March 16, 2026 — six weeks before Medtronic confirmed the intrusion — we published a complete attack-surface matrix for the medical device vertical. It lives at sales/verticals/medical-devices/shodan-complete-matrix.md in our private operations repo and was emailed to every medical device prospect we'd been pitching that month.
The relevant rows:
Company | Subs | Dev/Test | %Dev | VPN | API | Healthcare | AIPM | Breached |
Stryker | 920 | 315 | 34% | 25 | 62 | 43 | 46 | Active (Iran/Handala) |
Medtronic | 915 | 239 | 26% | 77 | 63 | 49 | 48 | 2023 insulin pump |
Abbott | 769 | 100 | 13% | 39 | 24 | 15 | 31 | 2022 pacemaker |
Baxter | 426 | 75 | 18% | 22 | 16 | 8 | 29 | 2022 infusion pump |
Philips | 185 | 51 | 28% | 5 | 40 | 5 | 31 | 2023 MRI/CT |
Boston Sci | 148 | 13 | 9% | 11 | 5 | 0 | 50 | No |
Datavant | 72 | 1 | 1% | 0 | 2 | 2 | 52 | No |
Intuitive | 6 | 0 | 0% | 0 | 0 | 0 | 48 | No |
The plain-English finding directly under that table read:
Highest Risk: Medtronic. 915 subdomains (nearly identical to Stryker's 920). 239 dev/test environments (26% of surface). 77 VPN/access portals — highest in the vertical. 49 healthcare-specific endpoints. 63 API endpoints. Previous breach history (2023 insulin pump vulnerabilities). If Handala pivots from Stryker, Medtronic's surface is equivalent.
And the rule we extracted from the dataset:
Companies with >200 dev/test subdomains have 100% breach rate (Stryker, Medtronic). Companies with <15 dev/test subdomains have 0% breach rate (Boston Sci, Intuitive, Datavant).
That rule holds. As of May 2, 2026, every company we placed on the >200 dev/test side of the line has been breached. Every company we placed on the <15 side has not.
On March 25 we published *"We Scored 8 Medical Device Companies on Pi Day. Two Got Hit."* That post named Medtronic in its scoring matrix alongside Stryker, Baxter, Datavant, Intuitive Surgical, and three others, and was distributed to the medical-device security press list. The post's closing line is the one that hurts to re-read this morning:
The gap between having the data and acting on it is where 200,000 devices get wiped.
We can now update that. The gap is also where nine million records walk out the door.
The infrastructure was already in our index
ShinyHunters did not appear out of nowhere. As of tonight our iocs index holds 23 ShinyHunters indicators under threat type ransomware, alongside 25 blog posts on the actor across our archive. The infrastructure breakdown:
IPs (10): 185.93.3.195, 191.96.207.179, 196.251.83.162, 163.5.210.210, 94.156.167.237, 23.94.126.63, 198.244.224.200, 163.5.169.142, 138.199.60.10, 54.251.184.9.
Phishing domains (12) — note the targeting:
corporate-microsoft.com, sharepoint-comcast.com — corporate identity provider impersonation
corporate-okta.com, signin-okta.com, okta-louisvuitton.com — Okta SSO impersonation
workday-hubspot.com, workday-nike.com — Workday HR portal impersonation
modernatx-zoom.com, recurly-zoom.com, get-carrot-zoom.com — Zoom-themed credential phishing
corp-hubspot.com, bless-invite.com — invitation-themed lures
One user-agent string: Salesforce-Multi-Org-Fetcher/1.0 — the actor's data-extraction tool when they pivot from initial access into a Salesforce tenant.
The pattern is unambiguous. ShinyHunters runs corporate identity-provider phishing (Okta, Workday, Microsoft, SharePoint), pivots into the SaaS estate (Salesforce, Zoom, HubSpot), and lifts records at scale. Medtronic uses Workday. Two of the twelve phishing domains we already had cataloged are explicitly Workday-themed.
If Medtronic was running Workday-aware DNS/email defenses, the IOCs we'd been publishing for months would have lit those defenses up.
Two attackers, one vertical, one window
This is not a single-actor story. We've been documenting a converging-pressure pattern on medical devices since March:
Handala (Iran's Ministry of Intelligence and Security): wiped 200,000 Stryker devices via Microsoft Intune on March 11. Our iocs index currently holds 131 Handala indicators.
Pay2Key (Iran-linked ransomware): hit a second unnamed U.S. medical institution within the same three-week window in March.
ShinyHunters (financially motivated, English-speaking collective): hit Medtronic April 17, claimed nine million records.
Three different threat groups, two different motivations (state retaliation versus criminal extortion), one vertical. That convergence is not coincidence — it is what happens when an industry with critical-infrastructure leverage and unhardened SaaS sprawl becomes the attacker's preferred path of least resistance.
Our March 16 matrix called it. Our March 25 post called it again. The May 2026 medical-device pitch ranked Medtronic at AIPM 52 with the explicit annotation "915 subdomains, 77 VPN portals (most in vertical)" — and went to every prospect on our list.
We notified them. The mailbox proves it.
Medtronic was not a DugganUSA customer. They were a high-priority prospect — Minnesota F500, twenty minutes from our office, sitting on Stryker's twin attack surface. Our data flagged them as the next likely victim. We sent the outreach.
We did not have to reconstruct this from memory. The send is in our Microsoft Graph API mailbox audit trail:
March 19, 2026 — [email protected] → [email protected] Subject: "AI Presence Assessment — medtronic.com (57/95)" Same-day inbound auto-reply: from [email protected] confirming delivery to their Product Security team's mailbox.
That's a confirmed delivery to a Medtronic Product Security inbox 34 days before ShinyHunters posted on the dark-web forum that they had nine million records, and 39 days before Medtronic publicly confirmed the unauthorized access.
We did not get a follow-up reply. The pitch did not convert. We do not know whether the assessment was opened, internally circulated, or filed. We do know the email arrived, because Medtronic's own autoresponder told us so.
If they had been a customer, this would have been caught
This is not a hypothetical. Every line below maps to a tool we ship today, used by paying customers, against IOCs we had indexed before the breach disclosure.
1. The STIX feed would have lit up. 23 ShinyHunters indicators sit in our iocs index right now under threat type ransomware — 10 IPs and 12 phishing domains. Two of those domains are explicitly Workday-themed (workday-hubspot.com, workday-nike.com). Medtronic uses Workday for HR. Our STIX feed is consumed at SIEM-ingest cadence — when these domains start resolving inside a corporate DNS log, the alert fires. Free tier covers 25 queries a day; Pro is $99/month for 2,000 queries. A SOC running this against their Workday-related telemetry catches the phishing-attempt trail before credentials are harvested.
2. The attack-surface scanner would have nominated the bullseye. We ran it on Medtronic on March 14 and again on March 16. The Medtronic surface report — 915 subdomains, 239 dev/test, 77 VPN portals (most in the entire vertical), 63 APIs — is exactly the inventory a CISO needs to prioritize Workday SSO and Okta hardening ahead of a known-active phishing campaign. Customers get the report on demand and a daily delta for any new subdomain added. Medtronic did not get the daily delta.
3. AIPM would have flagged the brand-impersonation pattern. Our AI presence model scores how the major LLMs and threat-intel feeds talk about a brand. Medtronic's score in March was 57/95 — middle of the vertical and dropping into a volatile range. Volatility in AIPM scoring is a leading indicator: when the underlying signals shift, attackers are forming opinions about the brand at the same time defenders should be. AIPM customers get weekly competitive comparisons; Medtronic's AIPM trajectory was a buying signal. They received the assessment number on March 19 and never engaged.
4. The threat-intel correlation would have made the connection. Our enrich-ioc API takes any indicator and cross-correlates it across nine indexes simultaneously — IOCs, CISA KEV, adversaries, OTX pulses, our blog. A Medtronic SOC with Jeevesus (our MCP server) plugged into Claude Desktop or Cursor could have asked, in plain English, "is workday-hubspot.com known?" and gotten back the ShinyHunters attribution, the related IPs, the actor's other phishing domains, our blog posts on the actor, and the related CISA KEV entries — in one round-trip, inside the analyst's existing AI workflow. Jeevesus is now in the official MCP Registry. It was not when Medtronic was choosing whether to engage.
5. The vertical baseline would have gone with the report. Boston Scientific has 148 subdomains, 13 dev/test, AIPM 50, no breach. Intuitive Surgical has 6 subdomains, 0 dev/test, AIPM 48, no breach. Same vertical, same regulatory regime, same buying centers. The data says discipline maps to safety. Customers get this comparison continuously; Medtronic got the snapshot once, on March 19, at the top of an email they did not reply to.
The honest summary: the IOCs, the attack-surface enumeration, the actor attribution, the brand-perception signal, and the cross-correlation tooling were all in our hands by mid-March. We sent the front door. They opened it. The data was on the other side. They did not walk through.
What our customers got
Datavant ([email protected]) signed in March. They have 72 subdomains, 1 dev/test environment, 0 IOCs in our feed, and one specific exposure — n8n.datavant.com running CVE-2025-68613 (the n8n RCE that hit CISA KEV March 11 with a March 25 deadline). They handled it. They have not been breached.
Stryker got our Pi Day analysis for free, after the fact. The 233 Handala-linked IOCs we indexed by March 16 — wiper hashes, C2 infrastructure — are the receipts on what their MDM admin account was actually communicating with before the wipe. The data was public. It was in our feed. The gap between having it and acting on it is where 200,000 of their devices went dark.
Boston Scientific, Intuitive Surgical: clean. Disciplined surface, low dev/test exposure, no breach. Two hours of analysis on Pi Day pre-validated what their CISOs had been doing for years.
What ships next — for the rest of the vertical
Medtronic is now in the past tense. Abbott, Baxter, Philips, Edwards, BD, ZimVie are still on the line. Specifically:
Abbott: 769 subdomains, 100 dev/test, 39 VPN portals. AIPM 31. 2022 pacemaker breach in the books. ShinyHunters' Workday and Okta phishing pattern would land cleanly against this surface.
Baxter: 426 subdomains, 2,620 IOCs already in our feed (highest in the vertical, mostly DoseIQ/Claria patient infrastructure). AIPM 29. Not yet hit publicly.
Philips: 185 subdomains, 51 dev/test, 40 APIs. AIPM 31. 2023 MRI/CT vulnerabilities still in CISA KEV.
The pattern that named Medtronic on March 16 names these three on May 2. The same data, the same rules. They are next.
If you work at any of them, or you know who does, the AIPM audit takes minutes at aipmsec.com — free for the first audit. The STIX feed is at analytics.dugganusa.com/stix — free for 25 queries a day, $99/month for 2,000. The attack-surface scanner is auth-gated but available to any prospect on a 30-minute call.
The data is in the index. The IOCs are in the feed. The pattern is in print. We will publish the next prediction tomorrow. Whether you want it to be your company's name in the next disclosure is a decision you make today.
Receipts referenced
Mailbox audit (Microsoft Graph API): [email protected] → [email protected], March 19 2026, "AI Presence Assessment — medtronic.com (57/95)". Inbound auto-reply same day from [email protected]. Send-receipt and delivery confirmation both retained.
sales/verticals/medical-devices/shodan-complete-matrix.md — March 16, 2026 vertical attack-surface matrix
sales/verticals/medical-devices/medical-devices-pitch-may2026.md — current month's outbound deck
authoring/blog/medical-device-vertical-two-hit.md — March 25, 2026 published post
authoring/blog/war-footing-guide-march-2026.md — Defender's guide for the Iran-China-Russia escalation window
iocs index live counts as of 2026-05-02: 23 ShinyHunters indicators, 131 Handala indicators, 2,620 Baxter-related, 1,130,438 IOCs total
Public reporting: Health Exec on Medtronic confirmation; The Register on Medtronic + Itron joint write-up; Recorded Future The Record on Covenant Health Qilin
— Patrick Duggan, DugganUSA LLC. The data above is real, current as of the publish timestamp, and reproducible from our public APIs at analytics.dugganusa.com.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.