The hacking group ShinyHunters says it walked off with 284 million records from McKesson, and the supplier has now confirmed it was breached. McKesson, which sells medical devices and pharmaceuticals, acknowledged the attack on Friday after the hackers went public with their claim.
CyberInsider was first to report it, speaking directly to ShinyHunters. The group is known for going after healthcare and public sector targets. If its numbers hold up, tens of millions of patients are affected.
McKesson posted a disclosure statement on its website. “Upon discovery, we immediately activated our incident response protocols, launched an investigation, and engaged leading cybersecurity industry experts to assist in our response,” the company wrote. It promised identity theft protection for victims once they are all identified.
How the hackers say they got in
ShinyHunters told CyberInsider it phoned a couple of McKesson employees and talked them into handing over credentials. Those logins opened the door to data held with the company’s cloud storage partners, Salesforce and Snowflake. The group then demanded $55 million to delete what it took.
A regulatory filing with the U.S. Securities and Exchange Commission puts the discovery date at Aug. 25. McKesson is publicly traded, and it has said little else. It has not yet worked out what the breach will do to its business, and it has neither confirmed nor denied the hackers’ specific claims.
What was taken
The hackers released a sample of the data, and it contains sensitive personal details, including diagnoses and treatments. They say patient files include full names, home addresses, dates of birth, phone numbers, emails and Social Security numbers, plus medical record numbers. They also claim prescription records and even autopsy details. For some patients, they say, they hold predictive data used to assess cancer risk.
In a weekend update, McKesson said the stolen data was “associated with a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units.”
The haul may not stop at patients. CyberInsider quoted ShinyHunters as saying the dataset also holds employee records, with names, addresses, departments and job roles, and information on physicians and clinics that use McKesson. Messages between doctors and patients were taken too, the group said, though only the email text and not attachments. Reporters noted that doctors’ names, contact details and the size of their practices may be readable in some records.
Nobody has said whether ransomware was used. CyberInsider’s report does not cover it. McKesson says its investigation is still running.
