Author: Alexander Ivanyuk — Senior Director, Technology
Incident of the month In April 2026, medical device giant Medtronic disclosed that hackers breached its network and accessed data in “certain corporate IT systems,” following claims by the ShinyHunters extortion group that it stole more than nine million records from the company. Medtronic stated the incident did not impact customers or products and that its business operations remained unaffected, emphasizing separation between corporate IT networks and product/manufacturing environments.
Medtronic did not publicly attribute the attack or detail the intrusion method, but BleepingComputer reported that ShinyHunters listed Medtronic on April 18 and threatened to release the data unless the company engaged in ransom negotiations by April 21; at the time of reporting, Medtronic said it was still investigating whether personal data had been accessed and would notify affected individuals if exposure was confirmed.
This incident reflects a continuing data-extortion pattern where attackers monetize access even when operational disruption is limited, increasing pressure through leak threats and short negotiation windows. It also aligns with a broader trend of targeting corporate identity and SaaS ecosystems: In a separate April 2026 breach disclosure, ADT said attackers accessed some customer PII, and ShinyHunters told BleepingComputer it allegedly gained entry by compromising an employee Okta SSO account via voice phishing (vishing) and then extracting data from Salesforce — illustrating how a single identity compromise can rapidly translate into large-scale data exposure.
April malware threat detections
In April 2026, the percentage of unique Acronis clients with at least one malware threat blocked at the endpoint increased to 6.8%, up 0.4 percentage points from 6.4% in March 2026. This is the highest level recorded in the period shown and extends the sharp rebound that began in March after several months of comparatively stable malware exposure.
Compared to February 2026, when the share stood at 4.2%, April was 2.6 percentage points higher. It was also 0.7 percentage points above June 2025 (6.1%), showing that malware exposure has moved beyond mid-2025 levels rather than only returning to them.
In April, the top three countries with the highest malware detection rates shifted again compared to March. Palestine recorded the highest rate globally, with 51.9% of affected unique clients experiencing at least one malware detection, followed by Vietnam at 35.9% and Iraq at 28.8%.
Compared with March, when Vietnam led at 33.5%, followed by Georgia (24.1%) and Kazakhstan (20.3%), April showed renewed concentration in Palestine and a continued elevated level in Vietnam. Palestine returned to the top position at 51.9%, only slightly below its February level of 52.5%, while Iraq entered the top three and replaced the March leaders Georgia and Kazakhstan.
Across the focus countries, April 2026 showed a broad increase compared with March: Every country in the table recorded a higher normalized URL detection rate month over month. Singapore posted the highest April rate at 13.1%, followed by Brazil at 12.8% and Colombia at 12.2%. Brazil remained among the highest-rate countries, while Singapore moved from an already elevated 9.6% in March to the top position in April.
The largest month-over-month increases were recorded in New Zealand (5.6% to 9.4%, up 3.8 percentage points), Singapore (9.6% to 13.1%, up 3.5 percentage points), and Colombia (8.8% to 12.2%, up 3.4 percentage points). The United States also rose from 8.8% to 11.4%, while Germany increased from 8.8% to 11.1% and Australia from 6.2% to 8.5%. South Korea was the only market with a nearly flat change, edging up from 8.4% to 8.5%.
Compared to the March narrative, where the main theme was geographic redistribution with pressure concentrated in Brazil and Singapore, April pointed to a more uniform increase across the focus countries. The strongest pressure remained in Singapore and Brazil, but the upward movement was not limited to those markets; several countries that had been lower in March, including New Zealand, Australia, Japan, Mexico and the United Kingdom, also moved higher. Overall, the data suggests a broader expansion of URL-based threat activity across the focus-country set in April, with only limited evidence of stabilization.
Protection
The threats can be detected and mitigated with solutions from Acronis.
Acronis Cyber Platform protects against both known and never-before-seen threats through a multilayered protection approach. This includes behavior-based detection, AI- and ML-trained detections and anti-ransomware heuristics, which can detect and block encryption attempts and roll back any tampered files automatically without any user interaction.
Additional email security and URL filtering can help you protect against social engineering threats. Acronis GenAI Protection, natively integrated in the Acronis platform, gives you visibility and control over AI usage, blocks sensitive data sharing and detects harmful prompts. Acronis XDR for Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) brings the visibility needed to understand attacks while simplifying the context for administrators and enabling efficient remediation of any threats.