McKesson data theft affects oncology customers; 284 million records remains an attacker claim
McKesson confirmed data theft involving some oncology and specialty-care customers. Attackers claimed 284 million records, not people; the patient total remains unconfirmed. Check any breach notice and verify unexpected medical or billing calls.
If you or a parent receives cancer or specialist care, ask the clinic whether your information was involved and follow any verified breach notice. Check insurance statements for unfamiliar services, and verify unexpected treatment or billing calls using your clinic's usual number. If a notice confirms Social Security number exposure, consider a free credit freeze with the three US credit bureaux.
What’s happening
McKesson discovered the intrusion on 25 August and disclosed it on 28 August. It confirmed data theft through third-party applications. ShinyHunters claimed responsibility and 284 million patient-related records, a count of data rows rather than people. Have I Been Pwned subsequently recorded 6.4 million unique email addresses in published files attributed to McKesson, spanning patients, staff, healthcare contacts and marketing recipients; this is not an official patient count. McKesson's September updates, quoted by The HIPAA Journal and Becker's, described potentially exposed identity, insurance, medical and payment information, and narrowed the patient-data scope to some Oncology & Multispecialty customers. Medical-Surgical exposure primarily involved business contacts and orders. The company reported no further unauthorised activity after its initial response and promised notifications. As at 3 November, the sources reviewed do not establish a final affected-person count, completed individual notifications, or recovery or deletion of stolen copies. There is no household software patch for this breach.
- What
- Breach
- Affects
- McKesson Oncology & Multispecialty and Medical-Surgical customer data
- Fixed in
- Nothing to patch
- Since
- 25 Aug 2026
- Closed
- 21 Sept 2026
Timeline
- Vendor revised
McKesson's update, reported by Becker's, placed the affected patient-facing applications within a subset of Oncology & Multispecialty customers; Medical-Surgical data primarily concerned business contacts and orders. It reported no indication that other units, including North American Pharmaceutical Distribution and CoverMyMeds, were affected, and promised legally required notifications while directing people to a substitute notice.
- Update
Have I Been Pwned added data containing 6.4 million unique email addresses after ShinyHunters published files it alleged came from McKesson. The service identified patients, staff, healthcare contacts and marketing recipients, and restricted searches to verified email owners because the breach includes sensitive information.
- Vendor revised
McKesson said potentially stolen information likely included patient names, contact details, patient IDs and dates of birth, according to The HIPAA Journal. Depending on the person, insurance, medical, billing, payment and Social Security information could also be involved; the review remained ongoing.
- Update
McKesson said its initial measures appeared to have stopped further unauthorised access, with no further unauthorised activity detected. Orders continued to be accepted and distribution centres remained open, according to its update reported by The HIPAA Journal.
- Made public
McKesson confirmed unauthorised access to third-party applications and data theft, warning of intermittent service degradation. ShinyHunters claimed 284 million patient-related data records; BleepingComputer said this meant rows of data, not 284 million people, and had not independently verified the claims.
- UpdateNothing to patch
McKesson discovered a cybersecurity incident affecting its information systems. The company later disclosed this discovery date in its SEC filing.
Sources
- McKesson Form 8-K: cybersecurity incident discovered on 25 August 2026McKesson · 28 Aug 2026
- McKesson discloses breach after ShinyHunters claims patient data theftBleepingComputer · 28 Aug 2026
- McKesson Cyberattack: Stolen Data Includes 6.4 Million Unique Email AddressesThe HIPAA Journal · 18 Sept 2026
- McKesson Data BreachHave I Been Pwned · 10 Sept 2026
- McKesson says cyber incident affected oncology, multispecialty customersBecker's Hospital Review · 22 Sept 2026
- McKesson Narrows Confirmed Data Theft from Its Cyberattack to Oncology and Multispecialty Customers, Promises Patient NoticesMedical Daily · 23 Sept 2026