Software Development Intern

Hackers claim millions of patient records stolen during data breach at healthcare giant McKesson. The company, which distributes medicines and medical devices to hospitals and healthcare practices across the U.S., said it was hacked and expects int A prolific hacking group has taken credit for last week's cyberattack against U.S. pharmaceutical distribution giant McKesson, leading to the latest spill of highly sensitive health data by an American healthcare company in recent months. McKesson confirmed Friday in a statement on its website that hackers broke into several of its cloud-hosted accounts earlier in the week and exfiltrated data, and that the company expected "intermittent service degradation" related to the incident. In a separate notice to customers, the company's chief technology officer, Francisco Fraga, said the stolen data relates to its oncology & multispecialty and medical-surgical units. The Texas-based company is one of the largest American distributors of pharmaceuticals, medicines, medical supplies, and technology to hospitals and healthcare providers across the United States, and as such handles a large amount of patient data. The ShinyHunters hacking group - one of the most active data-extortion crews of the past two years - told TechCrunch that it hacked the company's cloud environment by tricking several employees into granting the hackers access to McKesson's network by using phishing and social engineering tricks, which the group is known for. The hackers said they stole a range of personal information, such as names, addresses, and Social Security numbers, as well as protected health information, including diagnoses, medications, allergies, and patient notes. The hackers say they took millions of rows of patient data from the company's cloud-hosted Snowflake and Salesforce environments, but that they are unsure of how many individuals are ultimately affected. The stolen data also included McKesson employees' information, such as home addresses. ShinyHunters shared screenshots and a sample of the stolen data with TechCrunch, and IntelPro verified a small subset of it against public records. Bleeping Computer, which first reported the link to the ShinyHunters hacking group, said the hackers demanded a $55 million ransom from the company in exchange for not publicly releasing the stolen files. In a statement, McKesson spokesperson Kristina Chang said the company "continues to operate in all lines of business," and reiterated its public statement, and noted that McKesson believes it has no ongoing unauthorized activity in its systems. The company would not answer TechCrunch's questions about the incident, such as what the hackers demanded or how many individuals had data affected by the incident. McKesson is the latest healthcare company or medical device maker to be targeted in a string of cyberattacks in recent months, as hackers aim to steal large amounts of sensitive medical and health data that they can use to extort the companies into paying a ransom to keep it from being published. Last week, medical device maker Boston Scientific was hit by a cyberattack that knocked much of the company's network offline. The cyberattack had a similar effect to an incident earlier this year at another medical device maker Stryker, in which hackers abused a company's internal tools to remotely wipe thousands of employee devices. Abbott Laboratories and Medtronic have also experienced cyberattacks, while electronic patient records provider CareCloud and health tech company TriZetto had breaches affecting over 3 million patients each. The ShinyHunters hackers have also taken credit for sizable data breaches at Amazon-owned One Medical and dental insurance company DentaQuest following cyberattacks on their systems. _Lorenzo Franceschi-Bicchierai contributed reporting._ _Updated with comment from a McKesson spokesperson._

McKesson data breach exposes patient information after cloud attack. McKesson confirms a cloud security breach after hackers claim to have stolen millions of patient records, including sensitive health data. Aug 31, 2026 - 14:49 McKesson, one of the largest pharmaceutical distributors in the United States, has confirmed a cyberattack after hackers claimed to have stolen millions of patient records from the company's cloud environment. Discover more Discovering Emerging Tech Newsletters Implementing Enterprise AI And Machine Learning Tools Subscribing To Digital Newspaper Outlets McKesson said attackers accessed several cloud-hosted accounts and removed data from its systems. The company warned customers that some services could experience intermittent disruptions related to the incident. Hackers claim theft of sensitive healthcare data. The ShinyHunters hacking group claimed responsibility for the attack, saying it gained access through phishing and social engineering techniques targeting employees. The group said it obtained data from McKesson's cloud-hosted environments, including systems connected to Snowflake and Salesforce. The attackers claimed that the stolen information includes names, addresses, Social Security numbers, and protected health information such as diagnoses, medications, allergies, and patient notes. They said the breach involved millions of rows of data but could not confirm how many individuals were affected. McKesson said the affected information relates to its oncology, multispecialty, and medical-surgical business units. The company also said employee information, including home addresses, was among the potentially exposed data. Registering An LLC Online Healthcare sector faces continued cybersecurity pressure. BleepingComputer reported that the attackers demanded a $55 million ransom in exchange for not publishing the stolen files. McKesson has not confirmed the ransom demand. The incident follows a series of cyberattacks targeting healthcare companies and medical technology providers, in which criminals have focused on sensitive medical information for extortion. ShinyHunters has previously claimed responsibility for major healthcare-related breaches, including incidents involving Amazon-owned One Medical and dental insurance provider DentaQuest. Other healthcare organisations have also reported significant cyber incidents in recent months, increasing concerns about the protection of patient data across the medical industry.

McKesson confirms cyber incident after ShinyHunters claims patient-data theft. Healthcare and pharmaceutical-distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and the theft of data. McKesson Corporation is an American healthcare company that distributes pharmaceuticals and provides medical supplies, health information technology, and care management tools. McKesson says it discovered the cybersecurity incident on August 25, 2026, and that its investigation is still in early stages. "Based on our investigation thus far, including assessments by leading cybersecurity industry experts supporting our response, we've confirmed that the unauthorized access to certain third-party applications and the exfiltration of certain data was associated with a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units." For now, McKesson provides no information about the amount or nature of the stolen data. The attack has been claimed by ransomware/extortion group Shiny Hunters. On their leak site the group claims to have stolen hundreds of millions of records containing very sensitive information spanning from Personally Identifiable Information (PII) to Protected Health Information (PHI). The ShinyHunters extortion group told BleepingComputer that it was behind the attack, claiming it gained access after conducting voice phishing (or vishing) attacks - a form of social engineering - against multiple McKesson employees. Subsequently, the group said it used compromised Okta single-sign-on accounts to access Salesforce and Snowflake environments. It further claimed to have removed approximately 1 TB of data between August 21 and 25. The group also said the data includes roughly 284 million records, which does not necessarily mean they belong to 284 million unique patients. A combination of identity information and healthcare-related details could make affected people targets for convincing scams. Criminals could impersonate a pharmacy, insurer, medical provider, debt collector, or patient-support service and use personal details to make the approach appear legitimate. Healthcare data is especially useful in social-engineering attacks because it can be used to create a sense of urgency: Criminals could scare a target by sending a supposed prescription problem, unpaid claim, delivery issue, appointment change, or request to "verify" insurance details. At this stage, however, McKesson has not confirmed that any particular category of patient data was accessed. What to do if you're affected. While waiting for more information about the nature of the breach and how you might be affected, there are a few things you can do: * Check the company's advice. Every breach is different, so check with the company to find out what's happened and follow any specific advice it offers. * Change your password. You can make a stolen password useless to thieves by changing it. Choose a strong password that you don't use for anything else. Better yet, let a password manager choose one for you. * Enable two-factor authentication (2FA). If you can, use a FIDO2-compliant hardware key, laptop, or phone as your second factor. Some forms of 2FA can be phished just as easily as a password, but 2FA that relies on a FIDO2 device can't be phished. * Watch out for impersonators. Cybercriminals may contact you posing as the breached company. Check its official website to see if it's contacting victims, and verify the identity of anyone who contacts you using a different communication channel. * Take your time. Phishing attacks often impersonate people or brands you know and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts. * Consider not storing your card details. It's definitely more convenient to let sites remember your card details, but it increases the risk if a company suffers a breach. * Set up identity monitoring. This can alert you if your personal information is found being traded illegally online and help you recover afterward. Let's face it, an incognito window can only do so much. Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance. Malware Intelligence Researcher Was a Microsoft MVP in consumer security for 12 years running. Can speak four languages. Smells of rich mahogany and leather-bound books.