McKesson has confirmed that hackers accessed several cloud-hosted accounts and stole data, with the ShinyHunters hacking group claiming responsibility for the breach. The pharmaceutical distribution company said the incident affected systems tied to its Oncology & Multispecialty and Medical-Surgical businesses and could cause intermittent service disruptions.
McKesson disclosed the incident in an update on its cybersecurity information center. The Texas-based company distributes pharmaceuticals, medical supplies, and technology to hospitals and healthcare providers across the United States and handles large amounts of patient information.
ShinyHunters Claims Patient and Employee Data Theft
ShinyHunters told TechCrunch that it gained access by using phishing and social engineering techniques to persuade several McKesson employees to grant access to the company’s network. The group said it then accessed cloud environments hosted through Snowflake and Salesforce.
The hackers claimed they stole names, addresses, Social Security numbers, diagnoses, medications, allergy information, patient notes, and McKesson employee information including home addresses. ShinyHunters said the stolen material contained millions of rows of patient data, although the group could not determine the total number of people affected.
TechCrunch said the hackers provided screenshots and samples of the stolen information, and the publication verified a small portion against public records. BleepingComputer separately reported that ShinyHunters claimed to have stolen 284 million patient data records and demanded $55 million to prevent the files from being released publicly.
McKesson Says Operations Are Continuing
McKesson spokesperson Kristina Chang said the company continues to operate across all business lines and believes there is no ongoing unauthorized activity within its systems. The company did not disclose how many individuals were affected or respond to questions about the hackers’ demands.
The incident follows several other cyberattacks involving healthcare and medical technology companies. Boston Scientific experienced an attack in August that disrupted its global operations, while Stryker previously reported an incident in which attackers used internal tools to remotely wipe thousands of employee devices.
CareCloud and TriZetto have also reported breaches affecting more than 3 million patients each, while Abbott Laboratories and Medtronic have faced separate cyberattacks. ShinyHunters has additionally claimed responsibility for breaches involving Amazon-owned One Medical and dental insurer DentaQuest.
Featured image credits: Wikimedia Commons
For more stories like it, click the +Follow button at the top of this page to follow us.