Massive data breach at McKesson: Millions of patient records stolen
US healthcare giant McKesson confirms hackers stole sensitive patient data in a major cyberattack.
1Scale of the attack
McKesson, one of America's largest pharmaceutical distributors, was targeted by the ShinyHunters hacker group. The attackers breached the company's cloud environment, stealing millions of patient records from oncology and medical-surgical units. Compromised data includes personal information, diagnoses, medications, and medical notes. The company warned of potential service disruptions resulting from the incident.
2Attack methodology
ShinyHunters used phishing and social engineering tactics to compromise McKesson employees' credentials. Gaining access to Snowflake and Salesforce cloud environments, the group exfiltrated sensitive data. Known for previous attacks on OneMedical and DentaQuest, the hackers shared some technical details with TechCrunch. Their modus operandi typically involves initial access through employee credentials.
3Impacted parties
Both patients and employees were affected by the breach. Stolen data includes employees' home addresses. While hackers couldn't confirm exact numbers, estimates suggest millions of patient records were compromised. McKesson notified customers about the types of data exposed but didn't disclose quantitative details about the breach's full scope.
4Ransom demand
According to Bleeping Computer, hackers demanded $55 million ransom to prevent public release of stolen files. McKesson hasn't responded to this demand. ShinyHunters has employed similar extortion tactics in past attacks. The group often shares partial data samples with media outlets to substantiate their threats and pressure victims.
5Other healthcare attacks
McKesson is just the latest in a string of healthcare sector targets. Recently, Boston Scientific's network was crippled, while Stryker saw thousands of employee devices wiped remotely earlier this year. Abbott Laboratories, Medtronic, CareCloud and TriZetto also suffered breaches, each affecting over 3 million patients. The pattern suggests healthcare remains a prime target for cybercriminals.
6Data security concerns
Medical data is particularly valuable to hackers as it remains useful longer than financial information. Experts emphasize the need for increased cybersecurity investments in healthcare. Major distributors like McKesson serve thousands of providers, making single breaches potentially catastrophic. Cloud-based attacks are becoming increasingly common across the sector.
7Company response
CTO Francisco Fraga confirmed the incident in customer communications but maintained that operations continue. McKesson declined to share additional details while investigations proceed. The Texas-based company, critical to US healthcare infrastructure, didn't respond to TechCrunch's press inquiry. Their silence is notable given the breach's severity.
8Long-term implications
This breach may erode patient trust and prompt stricter industry regulations. Analysts recommend similar-sized companies review defense mechanisms immediately. Patient data security carries both legal and ethical imperatives. The attack's financial and reputational consequences could persist for months, potentially affecting McKesson's market position and partnerships.
Original article: TechCrunch — McKesson'da büyük veri ihlali: Milyonlarca hasta kaydı çalındı