Loading story…
Intuitive Surgical disclosed that attackers gained access to internal business administrative systems after stealing an employee's credentials in a phishing attack. The intrusion exposed customer business and contact information, employee data, and corporate files, while the company said the incident did not affect operations, hospital customer networks, or its core robotic surgery and digital platforms, including da Vinci and Ion systems. Intuitive said its robotic systems operate independently from the compromised internal business network and that hospital environments remain separately managed.
The company said it took immediate containment steps, launched an ongoing investigation, and notified data privacy regulators. Reporting also noted that Intuitive's network segmentation separated internal IT business systems, manufacturing operations, and digital products, which the company cited as the reason the breach did not spread into production or customer-facing clinical environments. Public details remain limited, including when the phishing attack occurred and when it was detected, but both reports indicate the incident was confined to internal business applications rather than operational or medical device infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
By March 16, Intuitive had not attributed the intrusion to any threat actor, and no group had publicly claimed responsibility. Public reporting also indicated that no malware details, post-exploitation tools, or forensic indicators had been released.
Intuitive disclosed that the phishing-related breach affected internal business systems and exposed customer and employee data, while stating that its da Vinci, Ion, and digital platforms, hospital customer networks, manufacturing systems, and operations were not impacted. The company also said it notified data privacy regulators and reported no operational disruption or patient safety risk.
After discovering the intrusion, Intuitive secured affected applications, activated incident response procedures, launched an investigation, reviewed security controls, and reinforced employee security awareness. The company said network segmentation helped contain the incident and prevent spread into operational environments.
Attackers used a phishing campaign to steal an Intuitive employee's credentials and gain unauthorized access to the company's internal administrative and IT business applications. The intrusion exposed customer business and contact information, as well as employee and corporate data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcerescana.com
Open sourcescworld.com
Open sourceteiss.co.uk
Open sourcescworld.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
iRhythm Holdings disclosed a material cybersecurity incident after attackers used social engineering to access certain third-party-hosted business applications and exfiltrate sensitive data. According to the company’s SEC filing, unauthorized activity was identified on June 8, and on June 9 a threat actor contacted iRhythm claiming to possess proprietary company information, patient **protected health information**, and other personal data, while demanding payment to stop the information from being publicly released. The company said the intrusion was confined to third-party business applications and that there is no evidence its products, clinical or medical device systems, customer connections, patient safety, manufacturing and distribution operations, or financial reporting systems were affected. iRhythm has not named a responsible group or disclosed how many individuals were impacted, and said it is still investigating with external cybersecurity experts whether the attacker’s claims fully match the data stolen; it also stated that payment card and financial account information were not involved and that it has not found evidence of ongoing unauthorized access.
Jun 29, 2026
Medtronic said an unauthorized party accessed data in portions of its corporate IT environment and that it has contained the incident, activated response procedures, and engaged external cybersecurity experts. The company said it has not identified any impact on **products**, **patient safety**, customer connections, manufacturing and distribution operations, financial reporting systems, or its ability to meet patient needs, stressing that corporate IT, product, manufacturing, and hospital customer networks are segmented. The disclosure followed extortion claims tied to **ShinyHunters**, which said it stole more than **9 million records** containing personally identifiable information along with terabytes of internal corporate data and briefly listed Medtronic on its leak site before the entry disappeared. Medtronic said its investigation is ongoing to determine whether personal data was accessed and that it will notify affected individuals and provide support services if exposure is confirmed, while separate reporting also linked the incident to **Handala**, underscoring uncertainty around attribution even as the breach itself has been confirmed.
Jul 2, 2026
A threat actor has claimed to have breached enterprise intelligence software provider **InfoDesk** and is offering the allegedly stolen data for sale on a dark web forum. Reporting indicates the sample data included five records from each of 18 organizations, along with InfoDesk records, and the actor claimed to hold as many as 1,000 records in total. The exposed information reportedly consists primarily of employee full names and corporate email addresses tied to major organizations, including firms in the pharmaceutical, healthcare, financial, consulting, and nonprofit sectors; Cybernews specifically said the data involved employees at companies such as **Moderna**, **Johnson & Johnson**, and **Bayer**. Researchers said the immediate danger is not large-scale identity theft but highly targeted phishing and social-engineering attacks. Because the records appear linked to a known enterprise vendor, attackers could use the contact details to craft convincing lures for credential theft, malware delivery, or follow-on business email compromise. The alleged incident adds to broader concerns over third-party supplier exposure, where compromises at service providers can create downstream risk for multiple corporate customers at once.
Jun 29, 2026