Cyber extortion is no longer a headline risk reserved for Fortune 500 companies. When Abbott Laboratories — a global medical device and healthcare giant — found itself investigating two separate cyber incidents tied to extortion claims in mid-2026, it sent a clear signal to businesses of every size: attackers are opportunistic, and no organisation is too small or too large to be targeted. If you run a small or medium-sized business, this story is worth paying attention to.
What Happened at Abbott and Why It Matters
Abbott confirmed it was looking into two distinct security incidents after threat actors made extortion demands, reportedly claiming to hold sensitive data. The details are still emerging, but the pattern is familiar. Attackers gain access to internal systems or data, often through stolen credentials or unpatched vulnerabilities, and then threaten to publish or sell what they've taken unless a ransom is paid. This approach — sometimes called double extortion — has become the preferred playbook for cybercriminal groups because it works even when a victim has solid backups.
For SMB owners, the critical takeaway is not the size of Abbott's IT team or their security budget. It's the method. Credential theft, infostealer malware, and exposed data sold on dark web markets are the building blocks of most extortion campaigns. These same tools are used against small businesses every day, often because smaller organisations have fewer controls in place to detect the early warning signs.
How Attackers Get the Keys to Your Business
Before an extortion demand lands in your inbox, there is usually a quieter phase that most businesses never see. Attackers spend time collecting information: leaked passwords from old breaches, session tokens harvested by infostealer malware, employee email addresses scraped from data dumps, or API keys accidentally pushed to public code repositories. By the time they move against you, they may already have working credentials to your email, your cloud storage, or your business software.
This reconnaissance phase is where the real risk sits for SMBs. A single employee reusing a password from a breached service, or a contractor whose laptop was infected with infostealer malware months ago, can hand an attacker everything they need. The breach that hurts you tomorrow may have its roots in data that has been circulating on dark web markets for years.
What Good Early Detection Actually Looks Like
The businesses that avoid cyber extortion are rarely the ones with the biggest security teams. They are the ones that catch the early signals before attackers can act on them. That means knowing when employee credentials appear in breach databases or infostealer logs, spotting when company data shows up on dark web forums, and checking whether internal tools or API keys have been accidentally exposed in public code.
Breachrr monitors exactly these sources — breach databases, infostealer dumps, dark web markets, public code repositories, and domain infrastructure — and surfaces the findings in plain language so you do not need a security analyst to act on them. When a threat actor is building a profile of your business, you want to know about it before they make their move, not after they send a ransom note.
Steps Your Business Can Take Right Now
The Abbott situation is a reminder that incident response after the fact is expensive and disruptive. Prevention and early detection cost a fraction of what a successful extortion attack takes from a business in downtime, legal fees, reputational damage, and potential ransom payments.
Start by auditing what is already exposed. Check whether any company email addresses and associated passwords appear in known breach data. Review whether employees are reusing credentials across personal and work accounts. Make sure multi-factor authentication is enabled on every business application that supports it. And consider whether you have any visibility into the dark web activity that might already involve your business.
Cyber extortion thrives on the gap between when attackers find your data and when you do. Closing that gap is the most practical thing any SMB can do in the current threat landscape. Run a free audit at breachrr.com/audit to find out what's already exposed about your business before someone else uses it against you.
Want to see if your company is exposed?