Twelve Weeks: From Acquisition to Attack

In mid-June 2026, roughly twelve weeks after the Exact Sciences deal closed, callers posing as internal IT support contacted multiple Abbott and Exact Sciences employees. The pretext, according to public reporting, was a routine-sounding request: an MFA settings update. That framing matters. It's designed to produce compliance without triggering suspicion, and it's the same pretext family this actor lineage has used across a documented run of incidents since late 2025.

Here's where it's worth getting specific about mechanism, because “vishing bypassed MFA” undersells what's actually happening. Public research into this actor family's tooling, from Okta's threat intelligence team and from Push Security's independent teardown of a related phishing panel, describes two distinct kit architectures in circulation:

Which architecture hit Abbott specifically isn't confirmed in current public reporting. What is consistent across both is the outcome: the attacker ends the call holding either a live authenticated session or a fresh set of credentials plus a valid MFA approval, sufficient to authenticate as the victim within minutes.

One additional technical claim is circulating in secondary coverage of this incident and deserves a confidence label rather than a flat statement: that ShinyHunters used the OAuth 2.0 Resource Owner Password Credentials (ROPC) grant type to authenticate with the vished credentials in a way that avoids triggering an interactive MFA prompt at all. ROPC is a legacy grant type that accepts a username and password directly, and depending on how a tenant's Conditional Access policies are scoped, it can sidestep interactive MFA enforcement entirely, which is exactly why Microsoft has spent the past two years pushing tenants to disable it. It's a plausible, technically coherent claim given this actor's broader tradecraft. It is not corroborated by Microsoft's own July 13 research for the Abbott incident specifically, and we're flagging it here as a reasonable hypothesis, not a confirmed fact.

With a compromised Entra identity in hand, the actor reached legacy Exact Sciences systems inside Cancer Diagnostics, systems Abbott's own July 16 statement describes as separate from Abbott's core infrastructure. Some secondary reporting describes follow-on bulk queries across connected platforms including ServiceNow, SharePoint, and Databricks. That level of detail is consistent with the actor's known post-compromise behavior elsewhere, but it hasn't been independently confirmed at the granularity a primary incident response report would provide, so treat it as directionally likely rather than established.

ShinyHunters claims a large haul: roughly 30 million records, about 1 million Social Security numbers, and 22 million doctor-patient conversation notes. None of these figures are independently verified. Abbott disputes the scope and has not confirmed a volume.

On July 4, 2026, a separate and apparently unrelated actor, ShadowByt3$, claims to have gained access to LabCentral using compromised customer credentials obtained from an unspecified prior source, a stealer log, a separate breach, a credential dump, current reporting doesn't say. From there, the group describes exploiting a self-described “weak point” in the externally facing environment. One secondary source characterizes that weak point more specifically: unauthenticated enumeration of API endpoints, combined with bulk file download unconstrained by rate limiting or access controls.

It's worth translating that claim into standard vulnerability taxonomy, with an explicit caveat about how thin the sourcing is. “Unauthenticated enumeration” paired with “bulk download without access controls” describes a pattern consistent with broken object-level authorization, OWASP API Security Top 10 category API1:2023, where a client can reach objects belonging to other customers simply by varying an identifier in the request, layered with a missing rate-limiting or resource-consumption control, API4:2023. The reported behavior, slow, paced exfiltration over multiple days targeting specific endpoint patterns rather than a single bulk pull, reads like an actor deliberately staying under a naive, volumetric detection threshold rather than triggering a request-count alert all at once.

We want to be direct about the limits of this reconstruction: it comes from a single secondary aggregator's paraphrase of the threat actor's own claims. It is not from Abbott, not from an independent technical researcher, and not from a primary disclosure. Present it as informed analysis of what the claimed behavior is consistent with, not as a confirmed root cause. Abbott, for its part, disputes the sensitivity of what was accessed, describing LabCentral's contents as public reference material, operating manuals, product specifications, and troubleshooting checklists, and says it has found no evidence sensitive customer or business information was exposed. ShadowByt3$ itself states no customer or patient data was taken, claiming only manufacturing certificates, regulatory documentation, and technical product files.

What each incident actually establishes. The ShinyHunters compromise is an identity-and-access failure at the human authentication layer: a phone call defeated MFA, not because MFA is inherently weak, but because push, SMS OTP, and TOTP are all phishable by a sufficiently interactive, adaptive attacker. The ShadowByt3$ claim, if the reconstruction above holds up, is an application-layer authorization failure, a different vulnerability class entirely, with a different fix. Keeping these distinct is the difference between a useful technical report and a generic one.