McKesson Confirms Customer Data Theft as ShinyHunters Threaten Leak
Summary
McKesson confirmed data exfiltration affecting customers in two business units. ShinyHunters threatens to publish the data and reportedly claims 284 million records were stolen; McKesson says services remain operational and its investigation continues.
Key points
- McKesson said it discovered a cybersecurity incident on August 25 involving third-party applications; the company says unauthorized access has been disrupted.
- The confirmed exfiltration involved data associated with a subset of customers in McKesson’s Oncology & Multispecialty and Medical-Surgical business units.
- McKesson said its services remain operational, it has reasonable assurance there is no ongoing unauthorized activity, and it continues to investigate the incident’s scope.
- McKesson has not disclosed the confirmed number of affected people or the types of data exfiltrated.
- ShinyHunters reportedly claims it stole 284 million customer records and demanded approximately $55 million; the group threatens to publish the information unless McKesson contacts it by September 1.
- The information ShinyHunters claims was compromised allegedly includes personal, health, medical, prescription, billing, employee, and physician or clinic records.
Article Details
- Victim Organization
- McKesson Corporation
- Victim Domain
- McKesson.com
- Incident Type
- Unauthorized access and customer-data exfiltration involving third-party applications
- Data Types Exposed
- Customer data (exfiltration confirmed by McKesson; specific data types not disclosed)
- Personally identifiable information (allegedly included, according to ShinyHunters)
- Protected health information (allegedly included, according to ShinyHunters)
- Medical and treatment information (allegedly included, according to ShinyHunters)
- Prescription and billing records (allegedly included, according to ShinyHunters)
- Employee records (allegedly included, according to ShinyHunters)
- Information about customer physicians and clinics (allegedly included, according to ShinyHunters)
- Affected Records
- ShinyHunters reportedly claimed to have stolen 284 million customer records; McKesson did not confirm this figure.
- Operational Impact
- McKesson said the unauthorized access had been disrupted and its services and systems remained operational and unaffected. The investigation was ongoing, and the scope of information accessed or acquired had not been fully determined.
- Ransom Or Extortion
- ShinyHunters threatened to publish the allegedly stolen information unless McKesson contacted the group to begin payment negotiations by September 1. The group reportedly demanded approximately $55 million; McKesson did not confirm the demand.
- Claim Status
- confirmed