McKesson has confirmed that hackers got into its systems. How much they took is still unclear. The group claiming the attack, ShinyHunters, says it has 284 million records. If that is true, tens of millions of patients are affected.
CyberInsider broke the story after ShinyHunters spoke to it directly. The group has a record of attacks on healthcare and public sector targets. McKesson, which supplies medical devices and pharmaceuticals, confirmed on Friday that the breach was real and put out a disclosure statement. It has not confirmed or denied the group’s specific claims.
How the hackers say they got in
Under the hood, the method was a phone call. According to CyberInsider, ShinyHunters said it voice-phished a couple of McKesson employees, who handed over credentials. Those logins opened data held with the company’s cloud partners Salesforce and Snowflake, and from there the group says it pulled files straight from McKesson.
The group listed patient names, home addresses, dates of birth, phone numbers, emails and Social Security numbers, along with medical record numbers. It also claimed prescription records, autopsy details and, for some patients, predictive data used to assess cancer risk.
CyberInsider said the haul may go further. In the outlet’s words, ShinyHunters says the dataset contains employee records and “information about physicians and clinics using McKesson services”, along with doctor and patient communications. The group said that covers only the text of emails, not attachments.
A sample the group released contains sensitive personal information, including details of diagnoses and treatments.
McKesson’s response
In a regulatory filing with the Securities and Exchange Commission, McKesson said it first discovered the “cybersecurity incident affecting its information systems” on Aug. 25. Over the weekend it added that the stolen data was “associated with a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units.”
“Upon discovery, we immediately activated our incident response protocols, launched an investigation, and engaged leading cybersecurity industry experts to assist in our response,” the company wrote. The investigation is ongoing. McKesson has promised identity theft protection for victims once they are all identified, and said it has not yet assessed what the breach means for its business.
ShinyHunters says it has demanded $55 million to delete the data. Whether the attackers deployed ransomware is not known, because CyberInsider’s report did not say.
