Artivion data breach exposes sensitive customer information

American medical device manufacturer Artivion Incorporated said the data security incidents it suffered last year compromised the sensitive personal data of its customers.

 

Headquartered in Kennesaw, Georgia, Artivion designs and manufactures medical devices and also distributes cryogenically preserved human tissues for cardiac and vascular transplants.

 

In a data security incident notice filed with the Office of Maine Attorney General, Artivion said that last year it detected suspicious activity within its internal network. The company immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

The investigation determined that an “unauthorised third-party gained access to our network between November 20 and November 21, 2024, and obtained certain files.

 

“We conducted a detailed review and analysis of the files involved to identify individuals whose information was included and confirm their contact information, which was recently completed on June 9, 2025, and identified some of your information,” Artivion said.

 

The compromised data included names, dates of birth, Social Security numbers, driver’s license, and passport numbers, direct deposit information, and health insurance information. The company is yet to share the number of affected individuals.

 

While Artivion found no evidence of the compromised information being misused, it advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

It has also offered two years of complimentary identity protection and credit monitoring services through Equifax to all affected individuals.

 

At the time of publishing, no known hacker group claimed responsibility for the cyber attack on Artivion. The medical device manufacturer also did not share details on who was behind the attack, how much data was compromised, or whether it has received a ransom demand.