McKesson Data Breach: Attacker Deadline Looms

Post Views: 11

McKesson Acknowledges Cyberattack Amid Ransom Deadline Healthcare provider McKesson Corporation has confirmed that unauthorized actors accessed and stole customer data from its systems, with the ShinyHunters cybercriminal group setting a September 9 deadline for potential ransom negotiations. The company, which supplies a significant portion of prescription medications to hospitals, pharmacies, and clinics across North America, also manages medical supplies, cancer treatment programs, and the Health Mart pharmacy chain. In a report submitted to the U.S. Securities and Exchange Commission, McKesson disclosed that a cybersecurity incident impacting its information systems was detected on August 25. The company’s official website noted that the breach involved third-party applications and data theft, though no systems were isolated as a result. On Saturday, McKesson confirmed that data linked to a subset of customers within its Oncology & Multispecialty and Medical-Surgical divisions had been compromised. The company stated that the unauthorized access had been terminated, emphasizing that its operational services remained unaffected. Affected individuals will receive complimentary credit monitoring and identity protection services. However, McKesson has not disclosed the specific data types exfiltrated, the number of affected individuals, or the identity of the perpetrators. The ShinyHunters group, known for orchestrating several high-profile data breaches, has listed McKesson on its Tor-based data leak platform. The group is demanding $55 million in ransom to prevent the public release of the stolen information. According to the extortionists, the compromised data includes personally identifiable information (PII), protected health information (PHI), medical records, prescription details, billing information, employee data, and information about the company’s physician partners and affiliated clinics. SecurityWeek has reached out to McKesson for further comments on the allegations and will provide updates if the company responds.