Exact Sciences (Abbott) Data Breach: Vishing and Connected SaaS

Abbott said on July 16, 2026 that it was investigating a cyber incident affecting a limited number of internal systems in its cancer diagnostics business, formerly Exact Sciences, maker of Cologuard. BleepingComputer reported that in mid-June an employee was targeted with voice phishing, a Microsoft Entra single sign-on account was compromised, and data was taken from connected platforms. The group named Microsoft Entra, ServiceNow, SharePoint, Databricks, and Coupa for this incident; the longer list of SaaS platforms that circulates describes the group's usual targets across many victims rather than what was taken here, and Abbott has not confirmed either.

An extortion group claimed responsibility and published data after a deadline passed, according to BleepingComputer. The group claimed tens of millions of rows of personal data and over a million Social Security numbers; BleepingComputer did not verify these figures. The HIBP service (haveibeenpwned.com) added about 10.9 million email addresses with associated health data. Abbott described the impact as limited, with no operational disruption.

Reports also described a separate incident affecting a LabCentral portal, claimed by a different actor. Abbott said that data consisted of public technical documents.

Voice phishing, or vishing, often involves attackers calling employees while posing as IT support and persuading them to approve an MFA prompt, install remote access software, or enter credentials on a fake site. With an SSO session, attackers can reach every connected SaaS application the user can access.

Several 2026 healthcare and services breaches followed the same pattern: attackers persuade an employee or help desk to hand over credentials or approve access, then use single sign-on to reach connected SaaS applications such as support platforms, CRMs, and file stores, and export data in bulk. Defences include phishing-resistant MFA, strict verification for help desk resets, conditional access, and monitoring SaaS audit logs for unusual exports.

Push-based and code-based MFA can be defeated by persuasion. Phishing-resistant methods, such as FIDO2 security keys or passkeys bound to the legitimate site, prevent attackers from reusing credentials even when a user is tricked.

Restrict SaaS access to managed devices, known locations, or compliant sessions. Require re-authentication for sensitive actions such as bulk export, and shorten session lifetimes for privileged access.

Analytics platforms such as Databricks can hold very large datasets. Access should be limited to those who need it, with alerts on large queries or exports and separation between production data and broadly accessible workspaces.

The incident occurred months after an acquisition. Integrating identity, security monitoring, and SaaS governance across merged organisations takes time, and attackers may target periods of transition when controls are inconsistent.

The number of people notified, the exact data types per platform, and how much of the attackers' claimed data is genuine had not been confirmed publicly at the time of writing.

Watch for phishing referencing screening tests or medical orders, check the HIBP service (haveibeenpwned.com), and follow guidance in any notification letter.

Enforce phishing-resistant MFA, train staff on vishing, restrict device and location access, limit export permissions, monitor SaaS audit logs centrally, and review integration and token permissions regularly.

Extortion groups inflate claims to increase pressure. Companies describe confirmed impact cautiously while investigations continue. Breach databases count what appears in leaked files. Readers should note who is making each claim and what evidence supports it.

When one identity reaches seven platforms, scoping requires audit logs from all seven. Centralising SaaS audit logs before an incident, and checking their retention, determines whether an investigation can establish what was taken.

The reported platforms include IT service management and procurement tools, not only CRM and storage. These systems often contain vendor contracts, internal tickets, and employee data, broadening the impact beyond customers.

One phone call reportedly reached seven separate platforms. Harden the identity, restrict and shorten sessions, and centralise SaaS logs well before you need them.

Healthcare providers and payers that exchange data with the affected business should check whether shared data was in scope, monitor for phishing that impersonates the company, and confirm notification responsibilities under their agreements.

Acquisition completed March 23, vishing in mid-June, Abbott statement July 16, leak deadline extended to July 21, 2026, per reports.