Systems marked “separate” by acquisition history still sat inside the attack path. Abbott’s cancer diagnostics business was hit through legacy Exact Sciences systems, which means the combined identity and systems boundary mattered more than the current corporate perimeter. If one trusted login reaches inherited assets, segregation on paper does not contain the blast radius.
Abbott said unauthorized access touched a limited number of internal systems in its Cancer Diagnostics business and did not affect operations, manufacturing, or lab work. It is also investigating a separate claim about its LabCentral portal. BleepingComputer reported ShinyHunters linked the Abbott case to vishing against employees and said the access came through a Microsoft Entra SSO account; the group’s extortion deadline was later pushed from July 18 to July 21.
That points to a wider failure mode in acquisition integration. Legacy systems can remain reachable long after they are described as isolated, and a compromised identity can bridge that gap even when the business is operationally ring-fenced.
Abbott probes two cyber incidents amid extortion claims
Abbott Laboratories is investigating two separate cybersecurity incidents after confirming unauthorized access to internal legacy Exact Sciences systems in its Cancer Diagnostics business, while also investigating a separate claim that attackers breached its LabCentral portal and stole company data.