Medtronic filed the 8-K on April 27: an unauthorized third party reached certain corporate IT systems. On July 2 the company said notifications to affected people had started, with 24 months of credit and dark web monitoring plus a dedicated call center attached.
Medtronic has not said how many people are involved or what data types were touched, and reports no evidence the material has been posted anywhere. Its assessment so far draws a clean line, with corporate IT on one side and product security, patient safety and manufacturing on the other, and no identified crossover.
That line is the one regulators and customers will test. A pacemaker company’s corporate network holds design files, service records and field data, and calling an incident corporate rather than product level is a conclusion the investigation has to earn.