Systems marked “separate” by acquisition history still sat inside the attack path. Abbott’s cancer diagnostics business was hit through legacy Exact Sciences systems, which means the combined identity and systems boundary mattered more than the current corporate perimeter. If one trusted login reaches inherited assets, segregation on paper does not contain the blast radius.
Abbott said unauthorized access touched a limited number of internal systems in its Cancer Diagnostics business and did not affect operations, manufacturing, or lab work. It is also investigating a separate claim about its LabCentral portal. BleepingComputer reported ShinyHunters linked the Abbott case to vishing against employees and said the access came through a Microsoft Entra SSO account; the group’s extortion deadline was later pushed from July 18 to July 21.
That points to a wider failure mode in acquisition integration. Legacy systems can remain reachable long after they are described as isolated, and a compromised identity can bridge that gap even when the business is operationally ring-fenced.