IRVING, Texas, Sept. 2 — McKesson Corporation, a major US medical device and pharmaceutical supply company, confirmed Friday that it was hit by a cyberattack that may have exposed patient data, with the hacking group ShinyHunters claiming responsibility for a breach compromising 284 million records. The company, which distributes pharmaceuticals and provides medical supplies, said it discovered the incident on Aug. 25 and immediately activated its incident response protocols.
In a disclosure statement, McKesson said it had launched an investigation and engaged leading cybersecurity industry experts to assist, vowing to provide identity theft protection services to victims once identified. ShinyHunters, a group known for attacks on healthcare and public sector entities, told CyberInsider that it gained access to McKesson’s network by voice-phishing employees.
The hackers said they obtained credentials that allowed access to data from cloud storage partners Salesforce and Snowflake, then made a ransom demand of $55 million to delete the data.
What was taken
The stolen trove, a sample of which was revealed by the hackers, includes sensitive personal information. Patient contact details — full names, home addresses, dates of birth, phone numbers, emails, and Social Security numbers — were reportedly exfiltrated, along with healthcare-specific identifiers like medical record numbers and extensive medical records ranging from prescription records to autopsy details. In some cases, the hackers claim, predictive health data used to assess cancer risk was also taken.
McKesson said in a weekend update that the stolen data was “associated with a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units.” The company has filed with the U.S. Securities and Exchange Commission but has yet to assess the impact on business operations or confirm the specific claims made by the hackers.
Beyond patients
The data may extend well past patient records. According to CyberInsider, ShinyHunters says the dataset contains employee records with names, addresses, email addresses, phone numbers, departments and job roles, as well as information about physicians and clinics using McKesson services. Doctor and patient communications have also been exfiltrated, though the threat actors said this concerns only email content, not attachments.
Physicians’ names, contact information, and practice details may also be discernible in the stolen files. It remains unclear if ransomware was deployed in the attack.
For communities across the region that rely on McKesson’s oncology and medical-surgical supply chains, the breach raises questions about how quickly affected individuals will be notified and what protections will follow. The company said its investigation remains ongoing as it works to “provide accurate and concrete information as it becomes available.” This is a developing story.
