Have I Been Pwned says about 424,000 email addresses, mostly of healthcare professionals, Medela staff and leads, were published after a ShinyHunters 'pay or leak' campaign against Medela (September 2026); no Medela statement found
Have I Been Pwned (HIBP) added Medela on 30 September 2026. HIBP says the Swiss medical device company was the target of a ShinyHunters 'pay or leak' extortion campaign in September 2026, and that the data allegedly obtained was later published and included about 424,000 unique email addresses belonging predominantly to healthcare professionals, Medela staff and leads.
HIBP says the data was primarily corporate contact information, including names, physical addresses and phone numbers, with some records also containing support tickets. HIBP has flagged the breach as sensitive, so an address can only be checked by its verified owner or through HIBP's domain search.
No public statement from Medela was found, and no Australian organisation is named.
UPDATE 22 Oct 2026: reworded so each claim is attributed to Have I Been Pwned, and removed wording its breach page does not support (source: Have I Been Pwned).
Correction (23 Oct 2026): removed the extortion group's contact deadline, which rested only on the group's own leak post. (source: https://haveibeenpwned.com/Breach/Medela)
- Product
- Medela corporate / healthcare-professional contact and support data (not a product CVE)
- Versions
- n/a — data exposure / extortion leak (not a versioned product flaw)
- Exploited in Australia?
- unknown
- Patch to
- AU health/med-device supply chain: treat unexpected Medela/clinical-vendor contact lists as phishing fuel; force password resets only where Medela credentials were reused; HIBP sensitive — check via verified dashboard/domain monitoring rather than public search. Not a version patch.