McKesson Confirms Data Theft; Extortion Deadline Nears

McKesson reported that attackers removed customer data from parts of its Oncology & Multispecialty and Medical-Surgical business units after a cybersecurity incident it discovered on Aug. 25.

In a filing with the U.S. Securities and Exchange Commission the company described the event as “a cybersecurity incident affecting its information systems.” A notice on McKesson’s website said the incident involved third-party applications and resulted in data theft. McKesson noted it would not disconnect systems and that unauthorized access has been disrupted. The company indicated its services were not affected and that it will provide complimentary credit monitoring and identity protection to impacted individuals.

McKesson did not disclose how many customers were affected, which specific record types were taken, or the identity of the attacker. The company confined its description to data tied to “a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units” without further breakdown of locations or clinics.

An extortion group identified itself as ShinyHunters and added McKesson to a Tor-based leak site, setting a Sept. 1 deadline to be contacted for ransom negotiations. The group claimed to have taken roughly 284 million customer records and sought about $55 million, asserting the files contain personally identifiable information, protected health information, medical and treatment details, prescription and billing records, employee files, and information about customer physicians and clinics. McKesson has not confirmed the scope or nature of those claims.

McKesson is a major distributor in the U.S. healthcare supply chain, delivering about one-third of prescription medicines to North American hospitals, pharmacies and clinics, supplying medical goods, supporting cancer and specialty care, and operating the Health Mart pharmacy franchise.

The company is continuing an investigation and said it will update stakeholders as it learns more. The attackers’ public posting and deadline create the potential for additional disclosures if negotiations do not occur by the stated date.