The breach is still being measured, and the public number has narrowed to a confirmed minimum. Medtronic has started notifying 3.8 million people, while ShinyHunters has removed its 9 million-record claim, which leaves open whether the gap reflects a negotiated resolution or a count that is still being reconciled.
Medtronic says the stolen data includes names, contact details, dates of birth, Social Security numbers, and health-related details. The company also says its products and manufacturing and distribution operations were not affected, and it has told regulators it saw no evidence the information was posted publicly.
For customers, the exposure is in identity fraud and scam leverage, not in a product compromise. For responders tracking healthcare extortion, the removal of the leak-site listing is a reminder that public evidence can disappear before the final victim count is settled.