abbott

Cybersecurity jobs available right now: August 18, 2026 CISO ADI Global Distribution | USA | Hybrid – View job details As a CISO, you will develop and lead ADI’s global security strategy to protect information assets, digital platforms, critical operations, and AI-enabled environments. Advise executives and the Board on cyber risk, resilience, regulatory compliance, and security posture while leading incident response, threat and vulnerability management, supply chain risk, and M&A security. Cybersecurity Analyst Schneider Electric | India | Hybrid – View job details As a Cybersecurity Analyst, you will monitor, triage, and investigate security alerts across SIEM, network, and OT/ICS security platforms in a 24×7 SOC environment. Analyze and enrich security events, manage incidents and escalations, maintain accurate case documentation, and support detection tuning, reporting, and SIEM operations. Cybersecurity Architect L’Oréal | France | On-site – View job details As a Cybersecurity Architect, you will design and implement secure enterprise architectures, services, and reusable security solutions. Advise project teams on security design, drive risk management, third-party security, and vulnerability remediation, and ensure security standards are embedded across the technology lifecycle. Get weekly updates on new cybersecurity job openings. Subscribe here! Cybersecurity Engineer GovCIO | USA | On-site – View job details As a Cybersecurity Engineer, you will support the RMF process and ATO readiness by developing and maintaining SSPs, SARs, POA&Ms, and eMASS documentation. Perform security testing, vulnerability scanning, patching, and control validation while managing remediation activities and supporting secure hardware deployments. Cyber Security Engineer Neros Technologies | USA | On-site – View job details As a Cyber Security Engineer, you will build and operationalize the enterprise cybersecurity program across security architecture, detection and response, governance, and automation. Manage the security technology stack, lead incident response, conduct vulnerability assessments and security testing, implement NIST 800-171 and ITAR-aligned controls, automate security workflows and detections, and establish security baselines, change controls, and awareness programs. Director of Information Security Panthalassa | USA | On-site – View job details As a Director of Information Security, you will define secure-by-default architecture and guardrails, strengthen identity and access management, harden critical systems, lead vulnerability management and incident response, conduct security architecture and risk reviews, and partner across the organization to drive remediation, audit readiness, and practical security standards. Head of Security Chamelio | Israel | On-site – View job details As a Head of Security, you will own Chamelio’s security strategy across product, engineering, cloud, corporate IT, and compliance. Embed security into the product and codebase, establish standards for AI and LLM features, strengthen access and endpoint security, and lead incident readiness, audits, vendor risk, and customer-facing security engagements. Founding Security Engineer Asymptote Labs | USA | On-site – View job details As a Founding Security Engineer, you will build the AI detection and response platform to secure complex agent environments. Engineer scalable telemetry, behavioral detections, investigation and response capabilities across AI agents, developer tooling, CI/CD, cloud, and enterprise infrastructure. Head of Cyber Security East Sussex County Council | United Kingdom | Hybrid – View job details As a Head of Cyber Security, you will provide strategic leadership across cybersecurity, information governance, and risk management to protect resilient public services. Partner with senior leaders, elected members, and external organizations to embed security into service design and transformation, enable informed risk decisions, and support secure information sharing across the Council and its partners. Information Security Support Engineer Landmark Group | UAE | On-site – View job details As a Information Security Support Engineer, you will secure and maintain company endpoints by ensuring required security tools, patches, and controls are properly deployed and compliant. Troubleshoot endpoint security issues, support incident and vulnerability remediation, maintain audit and compliance evidence, and partner with IT and business teams to address security risks. Network Security Engineer Kargo | USA | On-site – View job details As a Network Security Engineer, you will design and secure network architectures across cloud, on-premise, and IoT/edge environments. Implement firewalls, VPNs, segmentation, secure access, and edge connectivity while leading network monitoring, incident response, vulnerability remediation, and infrastructure hardening. Head of Cyber Security LION | Australia | On-site – View job details As a Head of Cyber Security, you will define and execute Lion’s cyber strategy across enterprise IT, OT, cloud, AI, and emerging technologies. Strengthen security capabilities across people, processes, and platforms, lead the cyber team and strategic partners, and advise senior leaders on cyber risk and investment. Principal Product Manager – Identity Threat Detection and Response Elastic | Canada | Remote – View job details As a Principal Product Manager – Identity Threat Detection and Response, you will define and own the vision, strategy, and roadmap for Elastic Security’s ITDR capabilities, including human, non-human, and AI agent identities. Partner with engineering, threat research, customers, and security teams to advance identity threat detection, investigation, and automated response, integrate identity signals across SIEM and XDR, and differentiate Elastic’s identity security capabilities in the market. Senior Cybersecurity Engineer Huntington National Bank | USA | On-site – View job details As a Senior Cybersecurity Engineer, you will manage and enhance internet proxy and filtering technologies to ensure secure, reliable internet access. Maintain configurations, support users, implement new security features and tools, integrate automation and monitoring systems, and partner with cybersecurity teams to improve security operations and automation. Senior Network Systems Engineer NetApp | Ireland | On-site – View job details As a Senior Network Systems Engineer, you will bridge network operations and NetDevOps by automating and managing global network, security, and hybrid data center infrastructure. Drive infrastructure as code, observability, and automated remediation across enterprise LAN, NAC, firewalls, and secure access platforms while improving reliability and uptime. Staff Cybersecurity Engineer Abbott | USA | Remote – View job details As a Staff Cybersecurity Engineer, you will drive AI-enabled cybersecurity workflows and product security strategy to reduce vulnerability risk and scale security decision-making. Lead release security readiness, vulnerability triage and remediation, validate security controls and fixes, and implement preventive measures across applications and platforms.

Abbott Laboratories, one of the world’s largest healthcare and medical device companies, is investigating two apparently unrelated cyber incidents after confirming unauthorized access to internal systems. While Abbott says there has been no impact on manufacturing, laboratory operations, or patient care, cybercriminal groups ShinyHunters and ShadowByt3$ claim the breaches were far more extensive. Those claims remain unverified at the time of writing and, so far, unsupported by publicly leaked data. The incidents reportedly involve Abbott’s Cancer Diagnostics business and its LabCentral customer portal for core laboratory diagnostics. According to a statement released by Abbott on July 16: “Abbott is investigating a cyber incident in which there was unauthorized access to a limited number of internal systems in our Cancer Diagnostics business only. This does not impact any business operations, product or product availability, manufacturing or lab operations, or our ability to serve patients.” Regarding LabCentral, Abbott told reporters that it is an externally hosted portal and that there has been “no known exposure of sensitive customer or business information.” ShinyHunters told BleepingComputer it stole internal documents, contracts, customer information, more than 22 million doctor‑patient notes, over 20 million medical orders, and more than one million US Social Security numbers, along with personally identifiable information (PII) such as names, addresses, dates of birth, emails, and phone numbers. On July 18, ShinyHunters gave Abbott until July 21 to respond before leaking the alleged data: “This is a final warning to reach out by 21 July 2026 before we leak along with several annoying (digital) problems that’ll come your way. Make the right decision, don’t be the next headline” The threat of “digital problems” is a familiar one from ShinyHunters. During the Canvas attacks, the group defaced school login pages and the Canvas app with an on‑screen ransom message. Separately, ShadowByt3$ claims it accessed the LabCentral portal on July 4, using compromised customer credentials plus a “weak point” in the environment, allegedly exfiltrating technical documentation, manufacturing certificates, operating manuals, technical specs, and regulatory docs for Abbott lab systems. If the attackers’ claims prove accurate, the breach could affect healthcare providers that use Abbott’s diagnostic systems and potentially expose sensitive patient and healthcare data. Abbott, however, says it has found no evidence that sensitive customer or business information was exposed through the LabCentral incident and has not confirmed any patient data was compromised. What we can reasonably assume to be true There was a genuine compromise affecting Cancer Diagnostics systems. Abbott has publicly acknowledged unauthorized access and engaged incident response and law enforcement. This doesn’t appear to be a purely “fake” extortion attempt. There was also a separate cyber incident involving the LabCentral portal. Abbott says the portal primarily hosts public reference material and that it has found no evidence that sensitive customer or business information was exposed. Both ShinyHunters and ShadowByt3$ have listed Abbott on their extortion sites and have provided narrative details to media outlets, so this is not just generic name‑dropping. As of the latest reporting, neither group has publicly released samples of the data they claim to have stolen. What Abbott customers can do There are some actions you can take if you are, or suspect you may have been, the victim of a data breach. Check the vendor’s advice. Every breach is different, so check with the vendor to find out what’s happened and follow any specific advice they offer. Change your password. You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose and store one for you. Enable two-factor authentication (2FA). If you can, use a FIDO2-compliant hardware key, laptop, or phone as your second factor. Some forms of 2FA can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished. Watch out for impersonation scams. Criminals may contact you pretending to be the company. Check the company’s website to see how it is contacting affected customers, and verify anyone who contacts you using a different communication channel. Take your time. Phishing attacks often impersonate people or brands you know, and create a false sense of urgency with messages about missed deliveries, suspended accounts, or security alerts. Consider not storing your card details. It’s definitely more convenient to get sites to remember your card details for you, but we highly recommend not storing that information on websites. Set up identity monitoring. Identity monitoring alerts you if your personal information is found being traded illegally online and helps you recover if your identity is stolen. What do cybercriminals know about you? Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online.

Abbott Laboratories is investigating two separate cybersecurity incidents after confirming unauthorized access to internal legacy Exact Sciences systems in its Cancer Diagnostics business, while also investigating a separate claim that attackers breached its LabCentral portal and stole company data. The company confirmed the Cancer Diagnostics incident after the ShinyHunters extortion gang added Abbott to its data leak site, initially threatening to publish allegedly stolen data after July 18 unless the company negotiated with the group, before later extending the deadline to July 21. When BleepingComputer asked Abbott about the alleged ShinyHunters incident, Abbott directed BleepingComputer to a statement published on its website. "Abbott is investigating a cyber incident in which there was unauthorized access to a limited number of internal systems in our Cancer Diagnostics business only," the company said. "This does not impact any business operations, product or product availability, manufacturing or lab operations, or our ability to serve patients." Abbott added that the security incident has not impacted any other Abbott businesses or systems, and said the legacy Exact Sciences systems are separate from Abbott's. The company said it activated its incident response procedures after it learned of the incident, engaged cybersecurity experts, and notified law enforcement. Abbott also stated that it does not expect the incident to have a material impact on its business or financial results. ShinyHunters claimed to BleepingComputer that it gained access through a vishing attack targeting several Abbott employees in mid-June. According to the threat actor, the attack allowed it to compromise a Microsoft Entra single sign-on (SSO) account and gain access to internal systems. Since last year, the extortion group has been conducting social engineering campaigns that target employees' Microsoft Entra, Okta, and Google SSO accounts. After gaining access to a corporate SSO account, the threat actors steal data from connected SaaS applications such as Salesforce, Microsoft 365, Google Workspace, SAP, Slack, Adobe, Atlassian, Zendesk, Dropbox, and many others. The extortion gang has been increasingly targeting medtech companies, including Medtronic, OneMedical, and AdaptHealth. BleepingComputer has learned that ShinyHunters was also behind the iRhythm data breach and targeted Stryker soon after the company recovered from a destructive Iranian data-wiping attack. When asked what data was allegedly stolen, ShinyHunters claimed it exfiltrated data from Microsoft Entra, ServiceNow, SharePoint, Databricks, and Coupa, including internal documents, contracts, and customer information. The threat actor further claimed to have stolen more than 30 million rows of customer personally identifiable information (PII) from multiple datasets containing names, email addresses, phone numbers, physical addresses, dates of birth, and more than one million Social Security numbers. The group also claimed to have stolen over 22 million client notes containing doctor-patient conversations, more than 20 million medical orders, and customer agreements and NDAs. BleepingComputer has not independently verified the threat actor's claims regarding the stolen data. Alleged breach at LabCentral customer portal The second incident involves a threat actor known as ShadowByt3$, who contacted BleepingComputer claiming to have breached Abbott's Core Laboratory diagnostics business through its LabCentral customer portal. The threat actor said it breached the unit via its LabCentral customer portal using compromised customer credentials after identifying what it described as a "weak point" in the environment. According to the threat actor, they gained access on July 4, 2026, after which they slowly exfiltrated files by targeting API endpoints. ShadowByt3$ claims the stolen data includes CE manufacturing certificates, operation manuals, technical specifications, regulatory documentation, product requirement archives, calibrator value assignments, assay files, and other product documentation related to Abbott's laboratory diagnostic systems. The group says no customer data was stolen, but claims it obtained sensitive business documents and intellectual property. It also provided BleepingComputer with screenshots and a file listing as purported proof of the intrusion. Abbott confirmed to BleepingComputer that it is aware of the "potential" cyber incident but disputed the threat actor's characterization of the data it claims to have stolen, stating that all data stored in the environment is public and not sensitive. "LabCentral is an externally facing third-party hosted portal used by Abbott's core laboratory diagnostics business," an Abbott spokesperson told BleepingComputer. "It houses publicly available technical product reference documents, including operating manuals, troubleshooting checklists and product specifications, and does not contain proprietary/sensitive customer or business information." At this time, neither ShinyHunters nor ShadowByt3$ has publicly released data they claim to have stolen from Abbott. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Several global giants listed as victims of the recent hacking campaign targeting Oracle E-Business Suite (EBS) customers have remained mum on the impact of the cybersecurity incident. The Cl0p ransomware and extortion group has taken credit for the EBS hacking campaign, which involved exploiting zero-day vulnerabilities to access data stored by organizations in Oracle’s enterprise management software. The compromised data was then leveraged for extortion. While Cl0p serves as the public-facing extortion brand for the campaign, the cybersecurity community believes the operation may have been driven by a cluster of threat actors, most notably FIN11. The hackers have listed more than 100 alleged victims of the Oracle EBS campaign on the Cl0p leak website, including organizations in sectors such as technology, telecommunications, software, heavy industry, manufacturing, engineering, retail, consumer goods, energy, utilities, media, finance, and entertainment. For most of the victims, the cybercriminals published torrent files pointing to information allegedly stolen from their systems. This indicates that these victims have refused to pay a ransom. A majority of the large organizations targeted in the campaign have issued a public statement confirming a data breach. Many claimed that the impact of the incident is limited, but still notified affected individuals about the potential risks. However, a handful of very large companies do not appear to have issued any public statements on the matter, neither to confirm nor deny being hit, nor even to say that an investigation is being conducted. This includes semiconductor and infrastructure software company Broadcom, engineering and construction firm Bechtel, cosmetics group Estée Lauder Companies, and medical devices and healthcare solutions provider Abbott Laboratories. They were all listed on the Cl0p website on or around November 20, 2025. It may take several months and even as much as a year for companies to investigate data breaches and determine their full extent. However, major companies typically acknowledge at least that an investigation is ongoing. Broadcom, Bechtel, Estée Lauder, and Abbott have not responded to repeated requests for comment. Data leaked by hackers SecurityWeek has not downloaded any of the leaked data, but has conducted a brief metadata and file-tree analysis of data allegedly obtained from some of the larger companies named on the Cl0p website and found that the files indeed originate from an Oracle EBS environment. In the case of Broadcom, the cybercriminals made public more than 2TB of archives allegedly storing files stolen from the company. The Estée Lauder torrent file points to 870GB of archive files. At the time of writing, the torrents pointing to Bechtel and Abbott files are still available, but no data could be retrieved for analysis. However, that does not mean the files are no longer accessible to cybercriminals, as they may also be circulated privately on underground forums. On the one hand, cybercrime groups like Cl0p frequently exaggerate the scope of their breaches, prompting many companies to quickly issue statements denying or downplaying the allegations to reassure customers and stakeholders that any impact was limited. Moreover, if no regulated data (such as health information, Social Security numbers, or payment details) was compromised, companies face no legal obligation to disclose the incident publicly. If the breach did not qualify as material, there is also no requirement under SEC rules to report it to investors. On the other hand, some organizations may deliberately maintain silence for strategic, PR, and legal reasons. Even acknowledging an ongoing investigation could invite lawsuits, short-seller pressure, or additional regulatory scrutiny. Related: Michelin Confirms Data Breach Linked to Oracle EBS Attack

A surge in model performance has reshaped OpenAI’s internal planning, the company revealed on Wednesday. According to a new report, capability assessments using capture the flag (CTF) challenges have shown improvement from 27% on GPT-5 in August 2025 to 76% on GPT-5.1-Codex-Max in November 2025. OpenAI has warned that some upcoming systems may reach “High” capability levels on its Preparedness Framework, meaning they could eventually assist with tasks ranging from complex intrusion operations to the development of zero-day exploits. Jon Abbott, co-founder and CEO of ThreatAware, said the warning underscores the need to focus on basic protections. “OpenAI’s warning that new models pose ‘high’ cybersecurity risks is exactly why getting the security foundations right is absolutely critical. AI might be accelerating the pace of attacks, but our best defense will continue to be nailing the fundamentals first.” The company also said it is preparing for that possibility by developing layers of safeguards intended to channel advanced capabilities toward defensive outcomes. OpenAI added that its main goal is to strengthen the position of security teams that remain outnumbered and under-resourced. Strengthening Industry-Wide Understanding To manage the dual-use risks inherent in cyber workflows, the company outlined a defense-in-depth strategy built on several components: Access controls, infrastructure hardening, egress controls and monitoring Training that steers models away from harmful requests while maintaining usefulness for education and defense System-wide detection tools that can block or reroute unsafe activity End-to-end red teaming by external specialists “These safeguards are designed to evolve with the threat landscape,” the company said. Abbott noted that rising capability makes long-standing threats more dangerous. “Old-school threats, when combined with the scale and precision enabled by AI, make for a particularly toxic combination,” he explained. “With models that can develop working zero-day remote exploits or assist with complex, stealthy intrusions, the barrier to entry for criminals has been dramatically lowered.” OpenAI said it is coordinating with global experts to improve real-world applications of defensive AI and is preparing a trusted access program for qualifying users. Another effort, Aardvark, is already in private beta. The agentic security researcher scans codebases, identifies vulnerabilities and proposes patches, and has uncovered new CVEs in open-source projects. OpenAI said it will also launch a Frontier Risk Council to advise on responsible capability use, with further collaboration through the Frontier Model Forum aimed at refining shared threat models and improving ecosystem-wide mitigation strategies. Image credit: Prathmesh T / Shutterstock.com

Windows 10 has reached end of support (EOS) today, October 14, 2025, but the operating system is still running on hundreds of millions of devices. With Windows 10 reaching EOS, Microsoft will no longer provide free software updates, technical support, or security patches. PCs running Windows 10 will continue to work, but they will become increasingly vulnerable to malware and other cyberattacks as new threats emerge and no patches are released. For users who cannot immediately upgrade to Windows 11, Microsoft has launched the Extended Security Updates (ESU) program. In order to enroll into the ESU program and get important security updates until October 13, 2026, consumers will be charged $30, while commercial organizations will have to pay $61 per device. The price will double each year for organizations that want ESU for up to three years. Individuals can also get extended security updates free of charge by using Windows Backup to sync their settings to the cloud, or by redeeming 1,000 Microsoft rewards points, which users earn for engaging with Microsoft products and services, such as Bing, Xbox and Microsoft Store. In addition, Microsoft announced recently that ESU will be free for users in the European Economic Area (EEA). It’s unclear how many users will opt for ESU, but a large number of devices will likely become increasingly vulnerable to attacks in the next months as Windows 10 still appears to have a market share of at least 40%, as reported recently by several third-party companies. Statcounter data for September 2025 showed that while Windows 11 had been running on nearly half of desktop machines, Windows 10 was also still installed on just over 40% of devices. An analysis conducted by remote access and support giant TeamViewer showed that more than 40% of global endpoints that recently received support via its software had been running Windows 10. TeamViewer’s analysis — based on 250 million remote support connections — showed that Windows 11 had been running on 47% of devices. Cybersecurity firm Kaspersky has also analyzed data collected from its customers and found that only 33% have upgraded to Windows 11 and 53% are still using Windows 10. Moreover, in the case of corporate users, Windows 10 is still present on nearly 60% of systems. Data shared by Microsoft in recent years puts the number of Windows users at well over one billion, which means hundreds of millions of computers are still running Windows 10. On the other hand, many organizations may be in the process of upgrading their devices. IDC reported last week that PC shipments during the third quarter of 2025 increased 9.4% compared to the prior year (global volumes reached 75.8 million units), and the surge is at least partly fueled by the transition to Windows 11. “Updating or decommissioning every endpoint is a major task, especially for larger enterprises,” said Jon Abbott, CEO and co-founder of ThreatAware. “Upgrading raises concerns about system reliability, prompting some organisations to delay migration until they are confident that critical systems will run smoothly.” Abbott pointed out that while ESU is a viable temporary solution, “In the long term, organisations must ensure that every Windows 10 device within their IT estate is either updated or decommissioned.” “Effective discovery requires consolidating data from sources such as Active Directory, SCCM, Intune and help desk logs, as well as identifying unmanaged BYOD and home-office PCs through agentless scanning. Only with comprehensive, up-to-date visibility can IT teams correctly prioritise assets and avoid unpleasant surprises mid-migration,” Abbott explained. He added, “Once the full scope of the challenge is understood, the next step is to set priorities. Not all endpoints merit equal urgency. Teams with Windows 10 devices handling sensitive data under GDPR, SOX or PCI-DSS should move to the front of the queue.” Related: Senator Urges FTC Probe of Microsoft Over Security Failures