Elekta AB Data Breach

On August 30, 2026, the extortion group shinyhunters claimed to have targeted Elekta AB, a Swedish organization operating within the healthcare sector. The claim was accompanied by significant credential exposure, including 15 records related to employee Microsoft 365 accounts, external records, and third-party integrations such as Marketo, Concur, and Hightail. The earliest captured credentials date back to April 30, 2024, suggesting a substantial period of potential compromise before the leak-site listing. shinyhunters asserted unauthorized access to Elekta AB’s systems and data, though no independent verification of these claims has been completed as of the reporting date. Over the preceding 60 days, shinyhunters has claimed 24 victims, with a notable concentration on entities in the US and Israel, and a primary focus on the Technology and Healthcare industries. Elekta AB, as a healthcare organization based in Sweden, aligns with the group’s typical sector targeting. The group maintains a moderate operational tempo with consistent targeting logic, suggesting their activities are methodical and predictable within their chosen victimology.

SOCRadar CTI’s analysis of stealer-log data indicated a severe exposure in the sampled data for Elekta AB. The telemetry identified two employee Microsoft 365 credentials, two external records, and eleven corporate third-party credentials linked to platforms such as Marketo, Concur, and Hightail. The timestamps for these exposed credentials range from April 30, 2024, to August 25, 2026, indicating that this data has been available for over two years prior to the threat actor’s claim. The identified credential exposure, specifically concerning employee M365 accounts, external records, and third-party service credentials, presents a potential pathway for unauthorized access. While the exact intrusion method used by shinyhunters is not confirmed, such exposed credentials could facilitate initial access, lateral movement, or privilege escalation within Elekta AB’s environment. This data could be leveraged to gain access to corporate systems, potentially enabling ransomware deployment or data exfiltration. Given the detected credential exposure and the threat actor’s claim, it is recommended that Elekta AB conduct a thorough review of its security posture. This includes continued monitoring of dark web and stealer-log feeds for any further exposure, proactive credential hygiene checks, and immediate password rotation for all potentially compromised accounts. A review of multi-factor authentication (MFA) enforcement, alongside monitoring of Microsoft 365, VPN, and remote-access portal activity, is also advised to detect and mitigate any ongoing or potential future compromise attempts.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.