In September 2026, Medela, a Swiss medical device company, fell victim to a ShinyHunters “pay or leak” extortion campaign. When the demand went unmet, the stolen data was published publicly, exposing roughly 424,000 unique email addresses tied predominantly to healthcare professionals, Medela staff and sales leads. The leaked records consisted mainly of corporate contact information such as names, physical addresses and phone numbers, with some entries also including support ticket details.
While no passwords or credentials appear to have been part of this dump, the exposure of verified professional email addresses and organizational contact data creates a strong foundation for targeted phishing and business email compromise. Attackers can use this validated directory of healthcare staff and leads to craft convincing spear-phishing lures aimed at harvesting credentials or seeding initial access.
What to take away: treat leaked contact directories as reconnaissance fuel. Organizations with staff in this dataset should reinforce phishing-resistant MFA, monitor for credential-stuffing and targeted social engineering, and remind employees that legitimate-looking outreach referencing internal support tickets may be weaponized.