Was It Breached Secria

Recent breaches

Medtronic data breach: the letter to device patients, and what to do

Medtronic makes medical devices. Its filing with Indiana's attorney general counts 3,834,294 people, as of 29 October 2026.1

Secure Processing Center
P.O. Box 3826
Suwanee, GA 30024

Date

Re: Notice of Data Breach

Dear Name:

As a patient with a Medtronic medical device, our company collects data related to you in order to provide important product-related updates ...

Your Medtronic Device Remains Safe. ... this incident did not impact the ability of any Medtronic device to operate safely and deliver intended therapy.

... Visit www.privacysolutionsid.com and click "Activate Account" ...

  1. The return addressThe filed sample comes from a Secure Processing Center in Suwanee, Georgia, under the heading "Re: Notice of Data Breach".2
  2. Why Medtronic has your dataYou use one of its devices. It keeps your details to send product updates and meet legal duties.2
  3. Your deviceThe company says the incident didn't affect how any device works. It says the same in its statement to investors.2,3
  4. The enrollment siteEpiq runs the monitoring. Type the site in yourself, with the activation code from your letter.2

Drawn from the sample letter Medtronic filed with California's attorney general. Checked 29 October 2026 against the sources.

The facts, as filed

"The company says" marks Medtronic's own account. A listing here isn't a finding that the company was at fault.

What happened
The company says it noticed unusual activity on 15 April 2026, and that an unauthorized actor accessed some of its corporate IT systems from 13 to 19 April 2026.2
People affected
3,834,294 in total, with 90,889 in Indiana, in Medtronic's filing with Indiana's attorney general, as of 29 October 2026.1 Its Texas filing, published 30 June 2026, counts 297,307 Texans.4 Medtronic is not on the federal HHS breach list.5
What leaked
The letter lists name, contact information, date of birth, Social Security number and health-related information. The company says it has no evidence the data was posted publicly.2
Monitoring offer
24 months of credit monitoring, dark web monitoring and identity theft restoration through Epiq, by the enrollment deadline printed in your letter.2
First disclosure
Medtronic published a statement on 24 April 2026 and filed it with the SEC. It said it had not found any impact on its products or patient safety, and didn't expect a material financial impact.3
Lawsuit
A proposed class action, Marquardt v. Medtronic, Inc., No. 0:26-cv-02418, was filed in federal court in Minnesota on 30 April 2026. Its claims are allegations, not findings.6

One week in April, letters by summer

The dates come from Medtronic's letter, its filings and the court record.

  1. Unauthorized access begins, the company says.2

  2. The access ends, after Medtronic noticed it on 15 April.2

  3. Medtronic's public statement, filed with the SEC.3

  4. A proposed class action is filed in Minnesota.6

  5. Letters go out, per Medtronic's Indiana filing.1

What to do if you got a Medtronic letter

The letter lists Social Security numbers, so these four come first. The full checklist covers every data type.

  1. Enroll in the Epiq monitoring before your deadline.IdentityTheft.gov says to accept free credit monitoring when a company offers it. Epiq's enrollment help line in the letter is 866-675-2006.7,2
  2. Freeze your credit.While a freeze is in place, nobody can open a new credit account in your name. It's free to place and to lift.7
  3. Get an IRS identity protection PIN.The six-digit IP PIN stops someone else filing a tax return with your Social Security number.8
  4. Keep using your device as your doctor advises.The company says the incident didn't affect any device. Questions about the letter go to Medtronic's line, 888-289-6806.2

Questions people ask

Is the Medtronic data breach letter real?

Compare yours with the sample Medtronic filed with California's attorney general: the Suwanee, Georgia return address, the "Re: Notice of Data Breach" heading, the line about your Medtronic device, and Epiq enrollment at www.privacysolutionsid.com.2 A letter isn't a reason to pay anyone or give your Social Security number over the phone.7

Was my Medtronic device affected?

The company says no: the incident was in corporate IT systems and did not affect any device's ability to operate safely and deliver therapy.2,3 If you have concerns about your device, ask your doctor.

Is there a Medtronic data breach settlement or payout date?

We found none as of 29 October 2026. A proposed class action was filed in federal court in Minnesota on 30 April 2026, and we found no court-approved settlement.6 A real settlement comes with a court-approved notice that names the case. This isn't legal advice.

Sources 8
  1. Data breach year-to-date report, October 2026, Office of the Indiana Attorney General. Medtronic Inc, notice sent 29 June 2026. Read 29 October 2026.
  2. Medtronic Inc.: filing and sample notice (reported 29 June 2026), California Attorney General. Read 29 October 2026.
  3. Form 8-K, Item 7.01, with the statement dated 24 April 2026, Medtronic plc, via SEC EDGAR. Read 29 October 2026.
  4. Data Security Breach Reports, Office of the Texas Attorney General. Medtronic Inc., published 30 June 2026. Read 29 October 2026.
  5. Breach Portal: HIPAA cases currently under investigation, U.S. Department of Health and Human Services, Office for Civil Rights. Full list exported as CSV. Read 29 October 2026.
  6. Marquardt v. Medtronic, Inc., No. 0:26-cv-02418, class action complaint (filed 30 April 2026), U.S. District Court for the District of Minnesota, copy hosted by ClassAction.org. Read 29 October 2026.
  7. What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach, IdentityTheft.gov, Federal Trade Commission. Read 29 October 2026.
  8. Get an identity protection PIN (IP PIN) (reviewed 4 August 2026), Internal Revenue Service. Read 29 October 2026.

Every breach is checked against the company's own notice and a government record, and every source shows the day we read it. How we check