Medtronic data breach: device patients' Social Security numbers and health data accessed, 3,834,294 people

What happened in the Medtronic cybersecurity incident?

The letter says Medtronic became aware of unusual activity on some corporate IT systems on April 15, 2026, and that an investigation found an unauthorized actor had accessed those systems from April 13 to April 19, 2026. Medtronic reported the incident to investors in a Form 8-K under Item 7.01, Regulation FD disclosure, rather than Item 1.05, the item for material cybersecurity incidents, and said it did not then expect a material impact on its business or results. The Item 8.01 versus Item 1.05 guide explains how companies choose between the items.

Its annual report, filed in June, repeated that and said Medtronic expected to begin notifying individuals as early as the first quarter of fiscal year 2027.

Date	What the filings, the letter and the regulators' records say
April 13, 2026	The unauthorized access begins; breach date on the California, Washington and Indiana records
April 15, 2026	Medtronic becomes aware of unusual activity
April 19, 2026	The access ends
April 24, 2026	Medtronic announces the incident; Form 8-K, Item 7.01
June 18, 2026	Annual report on Form 10-K filed
June 29, 2026	Notice recorded by California and Washington; report logged in Massachusetts; Indiana's report gives this as the date notice was sent
June 30, 2026	Posted on the Texas attorney general's list

75 days passed between Medtronic becoming aware of the activity and the first state records of notice.

What information was involved?

The letter is addressed to patients with a Medtronic medical device, whose data the company holds for product updates and legal obligations. It lists name, contact information, date of birth, Social Security number and health-related information, and says Medtronic has no evidence the information was posted publicly.

Washington, Texas and Massachusetts all record Social Security numbers and medical information for this report. Massachusetts marks financial accounts, driver's licenses and payment cards as not breached.

Are Medtronic devices affected?

No, according to the letter: the company says the incident did not affect any Medtronic device's ability to operate safely and deliver therapy. The 8-K said the investigation had found no impact on products, patient safety or manufacturing.

How many people were affected?

Regulator	What it counts	Number
Indiana attorney general	Total affected, as reported to Indiana	3,834,294
Indiana attorney general	Indiana residents	90,889
Texas attorney general	Texans	297,307
Washington attorney general	Washingtonians	64,035
Massachusetts consumer affairs office	Massachusetts residents	63,717

The report is eighth in the Washington ranking. Medtronic does not appear on the federal health breach list's open cases.

What is Medtronic offering people who got a letter?

Medtronic offers 24 months of credit monitoring, dark web monitoring and identity theft restoration through Epiq, at no cost.

Item	Detail from the letter
Provider	Epiq (Privacy Solutions ID)
Length	24 months
Enrollment	Activation code and deadline printed on each letter (blank in the filed copy)
Phone	888-289-6806, Monday to Friday, 9 AM to 9 PM ET

The letter also warns readers to be careful with unexpected emails, texts or calls asking for personal information. The credit monitoring offers guide compares other notices.

What the documents leave open

• How the unauthorized actor got in.
• How many of the people affected are device patients rather than others whose data Medtronic holds.
• Whether Medtronic will file a later 8-K or amend the first one.

Why did I get a letter from Medtronic?

The letter goes to patients with a Medtronic medical device, because Medtronic keeps their data to send product updates and meet legal obligations.