McKesson data breach affects 6.4 million individuals, ShinyHunters leak reveals

McKesson, a medical and pharmaceutical supply company supporting 3,300 oncology providers across 29 states, has not publicly confirmed the scale of the breach since its CIO and CTO last updated stakeholders on August 29. The HIBP analysis, which added the leaked data to its database, revealed that the impacted records include marketing campaign recipients, patients, staff, and healthcare provider contacts.

The types of exposed information vary between individuals but collectively include names, email and physical addresses, genders, dates of birth, phone numbers, employer details, and sensitive health information. ShinyHunters claimed the stolen data also contained Social Security numbers and detailed medical notes such as the locations of patients' cancers, though HIBP did not include SSNs in its assessment.

ShinyHunters told The Register that they issued a $55.2 million extortion demand to prevent the release of McKesson's data. The subsequent publication of the data suggests the demand was not met. McKesson has not responded to requests for comment on HIBP's findings.

The breach comes amid a spate of healthcare cyberattacks. Medical device maker Boston Scientific disclosed a separate incident that has disrupted its operations, leading the company to warn shareholders it expects to miss Q3 sales and earnings guidance. Healthtech firm Veradigm also reported a cyberattack to US regulators this week, after ransomware group The Gentlemen claimed responsibility for stealing 3.5 million records containing personally identifiable information, including Social Security numbers.

Why This Matters

The breach exposes sensitive health and personal data of millions of patients and healthcare providers, raising serious privacy and identity theft concerns.
The incident highlights the vulnerability of the healthcare supply chain to ransomware and extortion groups, with potentially cascading effects on patient care and trust.
McKesson's silence on the scale of the breach, despite HIBP's confirmation, underscores a lack of transparency that could attract regulatory scrutiny under data breach notification laws.

Background

McKesson is a major US medical and pharmaceutical supply company that provides oncology care support across 29 states. In August 2026, the company suffered a cyberattack claimed by the extortion group ShinyHunters, who are known for targeting healthcare and technology firms. Breach notification services like Have I Been Pwned track data leaks and help affected individuals assess their exposure. Similar attacks have recently hit other healthcare companies, including Boston Scientific and Veradigm.

Key Perspectives

McKesson: The company has not publicly confirmed the 6.4 million figure or provided further details since its late August update. It is likely working to notify affected individuals and restore systems while managing legal and regulatory obligations. ShinyHunters: The extortion group claims to have stolen 284 million documents and demanded $55.2 million. By publishing the data, they signal that the ransom was not paid, and they continue to use data leaks as leverage against medical targets. Have I Been Pwned: The breach notification service independently verified the leaked data, confirming the scope of the breach despite McKesson's lack of confirmation. HIBP noted that the data includes a wide range of personal and health information but did not verify ShinyHunters' claims about Social Security numbers.

What to Watch

McKesson's official breach notification to state attorneys general and affected individuals, which may reveal the exact number and types of records exposed.
Potential regulatory actions from HHS or state authorities for delayed or incomplete disclosure under HIPAA and data breach laws.
Further leaks or extortion attempts by ShinyHunters against other healthcare entities, as the group continues to target the sector.

ZOTPAPER