R&D Systems Intern

ShinyHunters expose 6.4M in attack on medical supplier McKesson. Source Originally from "ShinyHunters expose 6.4M in attack on medical supplier McKesson" by The Register - View original. Vendor risk governance failure: McKesson's 6.4M record breach exposes healthcare supply chain liability gaps. Why this matters at board and regulatory level. When ShinyHunters compromised McKesson - a critical medical supplier serving 3,300+ oncology providers across 29 states - the breach extended far beyond a single organization's data loss. The exposure of 6.4 million records spanning patient data, staff credentials, and healthcare provider contacts demonstrates a systemic governance failure: healthcare organizations lack binding contractual mechanisms to enforce, audit, and verify vendor security controls proportional to the sensitivity of data those vendors hold. The $55.2 million extortion demand reveals that threat actors now price attacks based on a vendor's position in the supply chain and the downstream liability exposure they create. This pricing model transforms vendor selection from a procurement decision into a board-level governance priority - yet most healthcare organizations remain unprepared to manage the cascading notification obligations, regulatory exposure, and liability allocation that follow a vendor breach of this scale. The supply chain leverage problem. McKesson's position as a critical infrastructure node in healthcare supply chains creates asymmetric risk exposure. A compromise at this level does not affect only McKesson's direct contractual relationships; it propagates through multiple layers of healthcare providers, patients, and staff. Yet the contractual frameworks governing vendor relationships typically fail to specify minimum security controls, real-time audit rights, or binding incident notification timelines. Most healthcare organizations discover - only after a breach occurs - that their vendor contracts lack clarity on who bears responsibility for notification costs, who funds regulatory remediation, and how liability is allocated if disclosure is delayed or incomplete. The concurrent breaches at Boston Scientific and Veradigm, both traced to compromised third-party vendor credentials, reveal a second structural weakness: credential hygiene and access control segregation across vendor ecosystems. When a single compromised credential grants access to multiple downstream systems, the breach becomes a supply chain cascade rather than an isolated incident. This pattern indicates that healthcare organizations have not implemented contractual requirements mandating multi-factor authentication, credential rotation, and access logging for third-party integrations. Under NIS2 and DORA frameworks, critical infrastructure operators and financial entities must assess and monitor supply chain security; healthcare organizations subject to similar regulatory expectations must translate these mandates into enforceable contractual language that specifies minimum technical controls, audit rights, and forensic disclosure obligations. Notification complexity and liability allocation. A breach affecting 6.4 million records triggers notification obligations under HIPAA, state breach notification laws, and potentially GDPR if European patients or providers are affected. However, contractual relationships between vendors and downstream customers often fail to allocate responsibility for notification timing, forensic disclosure, and regulatory reporting. Many healthcare organizations lack contractual clarity on whether their vendor must notify them within a specific timeframe, provide forensic details necessary for regulatory submissions, or assume liability for regulatory fines resulting from delayed or incomplete notification. This ambiguity creates operational chaos and legal exposure at the moment when coordinated, rapid response is most critical. The incident also exposes how vendor risk governance frameworks often overlook extortion as a distinct liability vector. A $55.2 million ransom demand creates pressure on the vendor to negotiate, potentially delaying breach disclosure to downstream customers and regulators. Contractual frameworks should explicitly prohibit vendors from negotiating ransom payments without notifying affected customers and should require vendors to maintain cyber liability insurance that covers both breach response costs and downstream customer notification obligations. Without these contractual anchors, healthcare organizations face scenarios where their vendor's negotiation decisions directly affect their own regulatory exposure and liability timeline. Cybersol's perspective: where governance frameworks break down. This incident reveals a critical distinction between technical security and governance-level risk management. The technical attack vector - credential compromise via a third-party vendor environment - is well-understood and preventable through standard access controls. The governance failure is contractual and organizational. Most healthcare vendor agreements were drafted before ransomware became a primary extortion mechanism, before supply chain attacks became the dominant attack pattern, and before regulators began holding organizations accountable for vendor security failures. Organizations typically overlook three specific risk layers: * Contractual specificity on security controls: Vendor contracts often reference "industry-standard security" or "reasonable safeguards" without defining what these terms mean operationally. Contracts should specify minimum technical controls (MFA, encryption, access logging), audit frequency, and remediation timelines for identified vulnerabilities. * Notification obligation clarity: Contracts should specify that vendors must notify the organization within 24-48 hours of discovering a breach, provide forensic details within 5 business days, and assume responsibility for notifying affected individuals if the vendor's negligence caused the breach. * Cyber liability insurance as a contractual requirement: Vendors should be required to maintain cyber liability insurance that covers breach response costs, notification expenses, and regulatory fines. This shifts financial risk to the vendor and creates an incentive for the vendor to maintain strong security controls. Most healthcare organizations have not integrated these requirements into their vendor management frameworks, leaving them exposed to the exact scenario McKesson's breach created: rapid escalation of liability, regulatory notification cascades, and contractual ambiguity about who bears the cost of remediation. Original source. The Register, "ShinyHunters expose 6.4M in attack on medical supplier McKesson" (September 10, 2026), reported by Connor Jones. Closing reflection. This incident demonstrates that vendor risk governance in healthcare remains reactive rather than preventive. Organizations should review the original article for specific technical details about the attack vector and credential compromise mechanisms. More importantly, they should use this incident as a trigger to audit their vendor contracts for explicit security requirements, notification obligations, liability allocation, and cyber insurance mandates. The governance failure here is not primarily technical - it is contractual and organizational. Healthcare boards should commission a vendor contract audit within the next 60 days, with specific focus on breach notification timelines, liability allocation, and cyber insurance requirements. The cost of updating vendor agreements is negligible compared to the regulatory exposure and notification costs that follow a breach of this scale.

FDA grants 510(k) clearance to SpaceOAR Flex Hydrogel for prostate radiotherapy. A limited market release of SpaceOAR Flex is expected to begin in the US later this year. The FDA has granted 510(k) clearance to the SpaceOAR Flex Hydrogel as a rectal spacer in men undergoing radiation therapy for .[1] The device is intended to temporarily position the anterior rectal wall away from the prostate during prostate cancer radiotherapy, with the goal of reducing the radiation dose to the rectum. The clearance expands Boston Scientific's SpaceOAR portfolio and follows earlier FDA clearances for SpaceOAR Hydrogel and SpaceOAR Vue Hydrogel. SpaceOAR Flex is designed with a flexible hydrogel delivery system that allows the physician to pause delivery, evaluate placement, and adjust delivery in real time, according to press communication from Boston Scientific. The system also uses a single-syringe delivery approach and is designed to reduce setup steps compared with the SpaceOAR Hydrogel and SpaceOAR Vue systems. "Rectal spacing has become an important tool for physicians seeking to limit radiation exposure to healthy tissue during prostate cancer treatment," said Ronald Morton, MD, chief medical officer, Urology, Boston Scientific, via press communication from Boston Scientific. "SpaceOAR Flex Hydrogel builds on our experience in this category and provides physicians with another option based on their clinical and workflow needs." The company also noted that SpaceOAR Flex is designed to be visible on computed tomography (CT) scans, including kV cone-beam CT, similar to SpaceOAR Vue. According to the company, this visibility is intended to facilitate contouring of the prostate and rectum during treatment planning and to assist with patient positioning during image-guided radiotherapy. The device is being assessed in the multicenter HYDROSPACE trial (NCT06451614). Preliminary results from the study will be presented at the 2026 American Society for Radiation Oncology Annual Meeting in Boston, Massachusetts. The randomized controlled trial is assessing the effectiveness and safety of the SpaceIT Hydrogel System for perirectal spacing in patients who are undergoing external beam radiotherapy for the treatment of low to intermediate risk prostate cancer. Participants in the control arm received either the SpaceOAR System or SpaceOAR Vue Hydrogel.[2] Boston Scientific said it expects to begin a limited US market release of SpaceOAR Flex later in 2026. SpaceOAR and SpaceOAR Vue will continue to be commercially available for rectal spacing. REFERENCES 2. SpaceIT Hydrogel System for Perirectal Spacing (HYDROSPACE). ClinicalTrials.gov. Last updated September 14, 2026. Accessed September 25, 2026.

All eyes on Athenry for Boston Scientific Play in Pink day in aid of NBCRI. Irish Golfer 24th September 2026 Irish Golfer Continuing their multi-year partnership with the National Breast Cancer Research Institute, Boston Scientific are holding their second annual Play in Pink day at Athenry Golf Club on Friday September 25th and it's all set to break some records. The Galway-based company are in the second year of a two year Charity Partnership with the NBCRI and to date they have run almost 90 events across that time where over €215k was raised in 2025 with the hope that 2026 will exceed that superb total. The Play in Pink day this week will be event #32 on their calendar for 2026 and it's a key one to help raise both funds and profile for the amazing work of the National Breast Cancer Research Institute as they continue in their quest to positively influence outcomes for people diagnosed with breast cancer through research. Breast cancer has touched most of its lives in one way or another and one in seven women in Ireland will be diagnosed with it in their lifetime, while one in two people in Ireland will be diagnosed with some form of cancer, so the research work of the NBCRI and the fundraising work of Boston Scientific and their partners is invaluable. In all Boston Scientific have 58 premium partners for their Play in Pink day and all deserve enormous praise for their involvement and contributions to making the day not only a fun golf day but one which raises significant monies for the charity. "We're delighted to be included in such a great event in aid of the NBCRI, it's great to be able to help out where we can and give back" said Sean Conroy from MJ Conroys Construction, one of the premier partners. While Vinny Kelly from Kirby Group Engineering said; "We're delighted to be a premier sponsor of this Boston Scientific's annual Golf Event and to support such a worthwhile cause. Kirby Group Engineering are proud to be able to help the NBCRI to raise valuable funds and awareness, and we're happy to support the great work that the charity is doing for advancements in cancer research" So you can see what it means for the partners to be involved and some of the others on the day will be; BWT Pharma & Biotech Ltd, Convergint Technologies Ireland Ltd, Interactive Interiors Ltd, John Sisk And Sons Limited, Kirby Group Engineering, Masterlift, Mj Conroy And Sons, Schneider, Electric Ireland Limited, Spectrum Engineering Limited, ABM, Siemens, Atlantach, EMC, Greatech, Hanley Control, Lotus, SVS and West Tech Irish Golfer wish Boston Scientific all the best on their Play in Pink day and extend a warm thank you to everyone involved in organising and supporting this wonderful event.