New York, September 3 McKesson Corporation, a medical device and pharmaceutical supply company, confirmed it was hit by a cyberattack that may have exposed patient data, with the incident first revealed by the hacker group ShinyHunters, who claimed credit for the attack and said it compromised 284 million records, impacting tens of millions of patients. According to CyberInsider, ShinyHunters gained access to McKesson’s network by voice-phishing a couple of employees who provided credentials allowing access to data from cloud storage partners Salesforce and Snowflake.
The hackers claimed to have exfiltrated files including patient contact details—full names, home addresses, dates of birth, phone numbers, emails, and Social Security numbers—plus healthcare identifiers such as medical record numbers.
Cyberattack Impact
A sample of the trove revealed by ShinyHunters contains sensitive personal information, including details on medical diagnoses and treatments. The hackers also claimed extensive medical records, from prescription records to autopsy details, and in some cases predictive health data used to assess cancer risk. McKesson said stolen data was “associated with a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units.” ShinyHunters made a ransom demand of $55 million to delete the data, though it is unclear if ransomware was deployed.
McKesson confirmed in a regulatory filing with the U.S. Securities and Exchange Commission that it first discovered the “cybersecurity incident affecting its information systems” on Aug. 25.
Response and Investigation
McKesson wrote: “Upon discovery, we immediately activated our incident response protocols, launched an investigation, and engaged leading cybersecurity industry experts to assist in our response.” The company vowed to provide victims with identity theft protection services once they are identified. The investigation remains ongoing, and McKesson is working to fully ascertain the nature and scope of the incident so that it can provide accurate and concrete information as it becomes available. As the situation develops, McKesson’s response will be crucial in mitigating the damage and protecting sensitive patient information.
The company’s ability to provide accurate and concrete information will be closely watched, and the outcome of the investigation will have significant implications for the company and its customers.
Next Steps
Looking forward, it will be important to watch how McKesson navigates this complex situation and what steps the company takes to prevent similar breaches in the future. The incident highlights the importance of robust cybersecurity measures and the need for companies to be vigilant in protecting sensitive data. As the investigation continues, more information will become available, and the full extent of the breach will be revealed.
