McKesson confirms cybersecurity incident as hackers claim millions of patient records stolen

A notorious hacking gang has claimed responsibility for last week's cyber assault on U.S. pharmaceutical distributor McKesson, resulting in the recent exposure of extensive patient data. McKesson affirmed Friday on its website that malicious actors infiltrated multiple cloud-based accounts earlier in the week and extracted information, while also anticipating "intermittent service disruptions" due to the incident.

In a separate communication to clients, the company's chief technology officer, Francisco Fraga, disclosed that the pilfered data pertained to its oncology and multispecialty, as well as medical-surgical divisions. Based in Texas, McKesson stands as one of the largest American providers of pharmaceuticals, medicines, medical equipment, and technology to hospitals and healthcare professionals nationwide, thereby managing vast quantities of patient information.

The ShinyHunters hacking collective - among the most prolific data-extortion groups over the past two years - disclosed to TechCrunch that they breached the company's cloud infrastructure by duping numerous employees into granting the attackers access to McKesson's network via phishing and social engineering tactics, techniques for which ShinyHunters is renowned.

The perpetrators asserted they obtained various personal details, such as names, addresses, and Social Security numbers, as well as protected health information, encompassing diagnoses, prescriptions, allergies, and patient records. They claim to have extracted millions of patient records from McKesson's cloud-hosted Snowflake and Salesforce platforms; however, they are uncertain about the exact number of individuals impacted.

The stolen data also encompassed information belonging to McKesson employees, such as residential addresses. ShinyHunters disseminated images and a sample of the stolen data with TechCrunch, and we confirmed a fraction of it against public records. Bleeping Computer, which initially reported the connection to the ShinyHunters hacking gang, stated that the threat actors demanded a $55 million ransom from the company in return for not releasing the stolen files publicly.

McKesson spokesperson Kristina Chang affirmed in a statement that the company "continues to operate in all business lines," and reiterated its previous assertion, noting that McKesson believes it has not experienced any ongoing unauthorized activity in its systems. The company declined to respond to TechCrunch's inquiries regarding the incident, including the hackers' demands and the number of individuals whose data was compromised.

McKesson joins a series of healthcare entities and medical device manufacturers targeted in a series of cyberattacks in recent months, as hackers seek to pilfer large volumes of sensitive medical and health data to extort companies into making ransom payments to prevent publication. Last week, medical device manufacturer Boston Scientific experienced a cyberattack that disabled a significant portion of its network.

The cyberattack bore similarities to an incident earlier this year at medical device manufacturer Stryker, where hackers exploited the company's internal tools to remotely erase thousands of employee devices. Companies such as Abbott Laboratories, Medtronic, electronic patient records provider CareCloud, and health technology firm TriZetto have also been victims of cyberattacks, with breaches affecting over 3 million patients each.

ShinyHunters has also admitted responsibility for significant data breaches at Amazon-owned One Medical and dental insurance provider DentaQuest following cyberattacks on their systems.