Exact Sciences Breach Exposes 10.9M Patient, Provider and Customer Records
What Happened — In July 2026 the ShinyHunters “pay‑or‑leak” extortion group published 10,869,543 unique records from Exact Sciences’ cancer‑diagnostics business. The dump includes email addresses, names, dates of birth, genders, phone numbers, physical addresses and personal health information.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient data‑protection controls in a third‑party health‑tech vendor.
- Highlights the need for continuous vendor‑risk monitoring and defensible evidence of encryption, access‑restriction and breach‑response processes.
- Provides a concrete audit‑ready control‑mapping example: a documented vendor‑assessment program can surface such gaps before data is exposed.
Who Is Affected – Healthcare providers, patients undergoing colorectal cancer screening, and other Exact Sciences customers.
Recommended Actions –
- Re‑evaluate any contracts or data flows that involve Exact Sciences or Abbott.
- Verify that encryption, least‑privilege access, and incident‑response procedures are documented and can be produced as audit evidence.
- Collect and retain evidence of these controls in a centralized Trust Center for continuous readiness.
Technical Notes – The breach was part of a “pay‑or‑leak” extortion campaign; the exact initial attack vector was not disclosed. Exfiltrated data spans personally identifiable information (PII) and protected health information (PHI). Source: Have I Been Pwned API, Abbott public notice