Pharmaceutical and healthcare technology giant McKesson confirmed it is experiencing intermittent service disruptions following a cyberattack involving a third-party application.
The company confirmed that attackers gained unauthorized access and exfiltrated data associated with customers in its oncology and surgical business units, although customers can continue using its systems and services. McKesson said it has received reasonable assurance that the attackers are no longer inside its systems.
The potential impact is significant given McKesson’s role in the healthcare supply chain: the company delivers approximately one-third of all prescriptions in North America and distributes pharmaceuticals, oncology drugs, medical-surgical supplies and laboratory equipment.
The ShinyHunters cybercrime group has claimed responsibility and threaten
Phil Wylie, Senior Consultant & Evangelist, Suzu Labs:
“The McKesson incident is another reminder that an organization’s attack surface extends well beyond the systems it directly controls. Third-party applications with access to sensitive data can provide attackers with a path around otherwise mature security controls.
“The potential impact is especially concerning in healthcare. When an organization sits at the center of the pharmaceutical and medical supply chain, a cyberattack is no longer just a data-security issue. Disruption can potentially ripple downstream to providers, pharmacies and ultimately patients.
“Organizations need to treat third-party access with the same scrutiny as internal access. That means limiting privileges, segmenting critical systems, continuously monitoring vendor connections and having an incident response plan that assumes a trusted third party could eventually be compromised.
“The reported 284 million records is a claim from the attackers and should be treated as unverified until McKesson confirms the scope. Regardless of the final number, this incident demonstrates why third-party risk has become one of the most important challenges in defending complex healthcare environments.”
John Strand, Owner, Black Hills Information Security, Inc.:
“This particular story highlights a major problem that I don’t think enough people spend time thinking about. Complexity is the enemy of computer security.
“The more third-party vendors you integrate with, especially SaaS providers, the larger your attack surface becomes. Every integration, API, application, and vendor relationship creates another potential path into your organization.
“I also don’t think enough is being done around supply chain security. Organizations should be asking harder questions of their SaaS providers, getting letters of attestation, understanding how these services are secured, and identifying exactly what access those vendors have to their environments.
“AI is going to make this problem even bigger.
“We’re seeing an explosion of custom-written SaaS applications because AI has dramatically lowered the barrier to building software. That’s fantastic in a lot of ways, but it also means we’re creating more applications, more integrations, more APIs, and ultimately more complexity at an incredible rate.
“We’re going to continue seeing vulnerabilities and compromises that originate with third parties. Attackers don’t necessarily need to attack you directly when they can attack something you trust.
“Once again, complexity is one of the easiest ways in.”
Damon Small, Board of Directors, Xcape, Inc.:
“When a third-party application breach hits a healthcare supply chain giant like McKesson, a single vendor integration can escalate into a national patient data crisis. The claim that 284 million records were exfiltrated is alarming, even if core delivery operations remain online. McKesson responded quickly by notifying the Securities and Exchange Commission and engaging external incident response specialists to contain the breach. However, given the company’s central role in drug and supply distribution across North America, organizations supporting critical infrastructure must apply far more rigorous scrutiny to the third-party software partners plugged into their environments. Security teams must enforce least-privilege access, continuously monitor data egress at vendor integration points, and audit partner security controls before a secondary application becomes a primary breach vector.
“Critical Takeaways
- Exfiltration claims of 284 million patient records demonstrate how third-party application vulnerabilities turn peripheral software into massive data exposure events.
- Rapid incident response, including SEC notification and external forensic engagement, is vital to containing blast radius when third-party access is compromised.
- Supporting critical healthcare infrastructure requires rigorous ongoing security auditing and strict access bounds for all vendor software integrations.
“When you deliver one-third of a continent’s medicine, your third-party vendors are no longer optional software; they are critical infrastructure.”
ShinyHunters have been busy. They pwned this company last week. That should tell you all you need to know about ShinyHunters, and what you need to do to defend against them.
UPDATE:ShinyHunters vished their way into a McKesson employee’s Okta credentials, then rode that single SSO account into Salesforce and Snowflake, pulling roughly a terabyte of data including Social Security numbers, medical records, and cause-of-death details, with a $55.2 million ransom demand and a 72-hour deadline attached.
iCOUNTER’s, Director of Counter Fraud Operations, Jason Brown said this:
“This is textbook third-party blast radius. The actual failure point wasn’t McKesson’s own perimeter, it was multiple employee SSO accounts, according to the attackers, that opened access to Salesforce and Snowflake, and that’s the exact chain most vendor risk questionnaires still don’t ask about, they check whether a vendor encrypts data at rest, not whether a single compromised identity can walk straight into critical SaaS platforms with no additional friction. From a fraud operations standpoint, the interesting clock now isn’t the breach, it’s the 72-hour deadline ShinyHunters set before publishing the stolen data, and once it’s published, the monetization happens fast because health data with Social Security numbers and diagnosis codes is high-value fuel for identity, medical, and synthetic identity fraud.”
Related
This entry was posted on August 31, 2026 at 3:15 pm and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
McKesson confirms data breach after ShinyHunters claims it stole 284M records
Pharmaceutical and healthcare technology giant McKesson confirmed it is experiencing intermittent service disruptions following a cyberattack involving a third-party application.
The company confirmed that attackers gained unauthorized access and exfiltrated data associated with customers in its oncology and surgical business units, although customers can continue using its systems and services. McKesson said it has received reasonable assurance that the attackers are no longer inside its systems.
The potential impact is significant given McKesson’s role in the healthcare supply chain: the company delivers approximately one-third of all prescriptions in North America and distributes pharmaceuticals, oncology drugs, medical-surgical supplies and laboratory equipment.
The ShinyHunters cybercrime group has claimed responsibility and threaten
Phil Wylie, Senior Consultant & Evangelist, Suzu Labs:
“The McKesson incident is another reminder that an organization’s attack surface extends well beyond the systems it directly controls. Third-party applications with access to sensitive data can provide attackers with a path around otherwise mature security controls.
“The potential impact is especially concerning in healthcare. When an organization sits at the center of the pharmaceutical and medical supply chain, a cyberattack is no longer just a data-security issue. Disruption can potentially ripple downstream to providers, pharmacies and ultimately patients.
“Organizations need to treat third-party access with the same scrutiny as internal access. That means limiting privileges, segmenting critical systems, continuously monitoring vendor connections and having an incident response plan that assumes a trusted third party could eventually be compromised.
“The reported 284 million records is a claim from the attackers and should be treated as unverified until McKesson confirms the scope. Regardless of the final number, this incident demonstrates why third-party risk has become one of the most important challenges in defending complex healthcare environments.”
John Strand, Owner, Black Hills Information Security, Inc.:
“This particular story highlights a major problem that I don’t think enough people spend time thinking about. Complexity is the enemy of computer security.
“The more third-party vendors you integrate with, especially SaaS providers, the larger your attack surface becomes. Every integration, API, application, and vendor relationship creates another potential path into your organization.
“I also don’t think enough is being done around supply chain security. Organizations should be asking harder questions of their SaaS providers, getting letters of attestation, understanding how these services are secured, and identifying exactly what access those vendors have to their environments.
“AI is going to make this problem even bigger.
“We’re seeing an explosion of custom-written SaaS applications because AI has dramatically lowered the barrier to building software. That’s fantastic in a lot of ways, but it also means we’re creating more applications, more integrations, more APIs, and ultimately more complexity at an incredible rate.
“We’re going to continue seeing vulnerabilities and compromises that originate with third parties. Attackers don’t necessarily need to attack you directly when they can attack something you trust.
“Once again, complexity is one of the easiest ways in.”
Damon Small, Board of Directors, Xcape, Inc.:
“When a third-party application breach hits a healthcare supply chain giant like McKesson, a single vendor integration can escalate into a national patient data crisis. The claim that 284 million records were exfiltrated is alarming, even if core delivery operations remain online. McKesson responded quickly by notifying the Securities and Exchange Commission and engaging external incident response specialists to contain the breach. However, given the company’s central role in drug and supply distribution across North America, organizations supporting critical infrastructure must apply far more rigorous scrutiny to the third-party software partners plugged into their environments. Security teams must enforce least-privilege access, continuously monitor data egress at vendor integration points, and audit partner security controls before a secondary application becomes a primary breach vector.
“Critical Takeaways
“When you deliver one-third of a continent’s medicine, your third-party vendors are no longer optional software; they are critical infrastructure.”
ShinyHunters have been busy. They pwned this company last week. That should tell you all you need to know about ShinyHunters, and what you need to do to defend against them.
UPDATE:ShinyHunters vished their way into a McKesson employee’s Okta credentials, then rode that single SSO account into Salesforce and Snowflake, pulling roughly a terabyte of data including Social Security numbers, medical records, and cause-of-death details, with a $55.2 million ransom demand and a 72-hour deadline attached.
iCOUNTER’s, Director of Counter Fraud Operations, Jason Brown said this:
“This is textbook third-party blast radius. The actual failure point wasn’t McKesson’s own perimeter, it was multiple employee SSO accounts, according to the attackers, that opened access to Salesforce and Snowflake, and that’s the exact chain most vendor risk questionnaires still don’t ask about, they check whether a vendor encrypts data at rest, not whether a single compromised identity can walk straight into critical SaaS platforms with no additional friction. From a fraud operations standpoint, the interesting clock now isn’t the breach, it’s the 72-hour deadline ShinyHunters set before publishing the stolen data, and once it’s published, the monetization happens fast because health data with Social Security numbers and diagnosis codes is high-value fuel for identity, medical, and synthetic identity fraud.”
Share this:
Like this:
Related
This entry was posted on August 31, 2026 at 3:15 pm and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.