McKesson confirmed that attackers accessed third-party applications and removed data connected to some customers.
The ShinyHunters extortion group claims it stole about one terabyte of data containing roughly 284 million records, but McKesson has not verified those figures.
Patients should be alert for convincing scams involving prescriptions, insurance claims, medical bills, or requests to verify personal information.
McKesson, one of the nation’s largest pharmaceutical distributors and healthcare-services companies, has confirmed a cybersecurity incident that may have exposed customer and patient information.
The company said it discovered the incident on Aug. 25 and determined that an unauthorized party had accessed certain third-party applications and taken data.
According to McKesson, the affected information was associated with a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units. The company said its investigation, supported by outside cybersecurity experts, remains in its early stages.
McKesson has not disclosed how many customers or patients may be affected or identified the specific types of information taken, according to a report from Malwarebytes.
Hackers make sweeping claims
The ShinyHunters cybercrime group has claimed responsibility for the attack. The group told BleepingComputer that it obtained access after conducting voice-phishing attacks against several McKesson employees.
Voice phishing, also known as “vishing,” typically involves criminals calling workers while impersonating technical support personnel, company officials, or other trusted parties. The goal is to persuade an employee to disclose login credentials or approve an authentication request.
ShinyHunters claims it used compromised Okta single-sign-on accounts to enter McKesson’s Salesforce and Snowflake environments. It says it removed approximately one terabyte of data between Aug. 21 and Aug. 25.
The hackers also claim the stolen files contain about 284 million records, including personally identifiable information and protected health information. That does not necessarily mean information belonging to 284 million different people was taken, because one person can have numerous records.
Those claims have not been independently verified, and McKesson has not confirmed that specific categories of patient information were compromised.
Why medical data is valuable
Healthcare information can be especially useful to criminals because it may contain a combination of names, addresses, dates of birth, insurance information, and details about medical treatment.
Even when stolen records do not contain payment card or bank account numbers, criminals can use personal details to construct highly convincing phishing messages.
Potential victims could receive calls, texts, or emails that appear to come from a pharmacy, doctor, insurer, medical supplier, or patient-assistance program. A scammer might claim there is a problem with a prescription, an unpaid bill, a canceled appointment or an insurance account that must be verified immediately.
The inclusion of accurate personal or medical details does not prove that a message is legitimate. Consumers should independently contact the organization using a phone number from its official website, an insurance card, or a recent statement.
What consumers should do
Because McKesson has not yet said who is affected, consumers may have to wait for additional information or an official notification. In the meantime, Malwarebytes recommends taking several precautions:
Be suspicious of unexpected messages about prescriptions, medical bills, insurance claims, or deliveries.
Do not provide passwords, authentication codes, Social Security numbers, or financial information to an unsolicited caller.
Change any reused passwords and give each important account a unique password.
Enable multifactor authentication wherever possible.
Review insurance explanations of benefits and medical statements for unfamiliar services.
Monitor bank and credit card accounts for unauthorized transactions.
Consider placing a free credit freeze with Equifax, Experian, and TransUnion if sensitive identity information is confirmed to have been exposed.
Consumers who discover evidence of identity theft can create a personalized recovery plan through the Federal Trade Commission’s (FTC's) IdentityTheft.gov website.
McKesson is expected to release more information as its investigation determines what data was taken and which customers or individuals were affected. Until then, the hackers’ claims about the volume and contents of the stolen records should be treated as unconfirmed.