AccidentalHealthcareTechnologyHealthcareMisconfigurationCustomer Data InvolvedData ExfiltratedPIIIdentity (basic)AuthenticationCredentialsLocationBehaviorMinorHighContained

MEDTRONIC MINIMED, INC.

bd_4e71eefd8325beec · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 13, 2023

Filed

Apr 14, 2023

To disclose

9 weeks

Affected

58,374state residents only

Confidence

66%

Full breach record for MEDTRONIC MINIMED, INC. →2 incidents on file

Medtronic MiniMed disclosed that tracking technologies (Google Analytics, Crashlytics, Firebase Auth) in its InPen App inadvertently transmitted user data to Google starting Sept 2020. Discovered Feb 13, 2023. Data included emails, IPs, passwords, and device IDs. No SSN or financial data. Notifications sent April 14, 2023. Google Analytics removed; migration to new platforms underway.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 60 days

Feb 13, 2023

Discovered

Apr 14, 2023

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed58,374 affectedView incident

Name: MEDTRONIC MINIMED, INC.
norm: medtronic minimed

Name: MEDTRONIC MINIMED, INC.
norm: medtronic minimed
Industry: HealthcarellmTechnologyllm

Discovered: Feb 13, 2023
Materiality determined: —
Notification sent: Apr 14, 2023
Affected individuals: 58,374state-resident count only
Data types: PIIIdentity (basic)AuthenticationCredentialsLocationBehaviorMinor
Attack vector: Misconfiguration
MITRE ATT&CK: T1071 Application Layer Protocol

During the incident: Removed Google Analytics from the latest version of the InPen App
Implementing a plan to transition from Crashlytics and Firebase Authentication to new crash reporting and authentication platforms
Proactively assessing how to further mitigate the risk of unauthorized disclosures of user protected health information
Continuing to monitor information security and technology solutions
Making improvements and enhancements where appropriate
Changes made: Removed Google Analytics from the latest version of the InPen App
Transitioning from Crashlytics and Firebase Authentication to new crash reporting and authentication platforms
Monitoring information security and technology solutions
Making improvements and enhancements to information security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-192.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 14, 2023
Raw hash: 48c52def6ea347de77e6c1aa0dddbb1696a6b69583413b17bfadba7dfeb25994

Reporting entityMEDTRONIC MINIMED, INC.

Victim entityMEDTRONIC MINIMED, INC.

Incidentdiscovered Feb 13, 2023

Stated responseRemoved Google Analytics from the latest version of the InPen App

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov