McKesson Confirms Break-In After Hackers Claim 284 Million Patient Records Stolen

Key points

• McKesson, the largest US pharmaceutical distributor, disclosed that intruders reached data held in third-party business applications.
• The extortion group ShinyHunters claims it stole 284 million patient records, a figure McKesson has not confirmed.
• McKesson says the affected systems held limited business information and no core patient medical records or prescription data.
• The company says it cut off the access, brought in outside investigators, and notified law enforcement.
• Patients are urged to watch for unusual medical bills, insurance letters or phishing emails referencing pharmacies.

McKesson, one of the biggest drug distributors on the planet, has confirmed a cybersecurity incident. The company moves medicines from manufacturers to pharmacies and hospital networks across the United States. It told regulators that outsiders got into some of its third-party business applications, meaning software McKesson rents from other vendors rather than runs itself.

ShinyHunters, a well-known extortion crew, started boasting on a leak site the same week. The group claims it walked off with 284 million patient records, a number that would cover close to every adult in the country. McKesson tells a smaller story: the company says the touched systems held "limited" information tied to its business operations, and that core patient records and payment card data were not in those systems. No victim count has been published.

What actually got taken?

McKesson has not said, in detail. The company describes the exposed material as limited business data sitting inside third-party apps, and says its main pharmacy and distribution systems were untouched. ShinyHunters is advertising a 284 million-record trove. Neither figure has been independently verified.

This gap between what a victim admits and what an extortion crew claims is normal. Criminal groups inflate numbers to push a ransom. Victims lean cautious while lawyers and forensics teams count rows. The truth usually lands somewhere in the middle, and it can take months to surface. ShinyHunters followed this same pattern when it dumped 12.9 million Carhartt customer records after a ransom refusal on 27 August.

How did the hackers get in?

McKesson hasn't named the vector. Based on the wording of the notice, the entry point was a third-party application rather than McKesson's own network. That pattern has become the defining breach story of 2025, and it's one we've tracked closely: our 21 August report on SickKids and LexisNexis's vendor server break-in on 10 August both turned on third-party access going wrong.

ShinyHunters has spent much of this year raiding cloud platform customer instances. In several cases, attackers tricked staff into approving a malicious connected app through OAuth, the authorisation standard that lets one application request access to another on a user's behalf. Once approved, the criminals could pull data through the API without touching a password. Whether McKesson's incident followed that script isn't yet public. It fits the shape.

Would MFA have helped?

Only partly. Multi-factor authentication, the second step after a password (usually a code or a tap on your phone), stops password theft cold. It doesn't stop a user from clicking "Allow" on a rogue OAuth consent screen. That's an authorisation problem, not an authentication one. The fix is tighter control over which third-party apps staff can connect, and review of the permission scopes those apps request.

What should patients do?

Nothing urgent, but pay attention. Watch for medical bills for care you didn't receive, insurance letters mentioning unfamiliar providers, and messages claiming to be from your pharmacy that ask you to click a link or confirm details. If McKesson eventually determines your data was involved, it's legally required to notify you and, in most cases, offer credit monitoring.

Don't act on unsolicited messages claiming to come from McKesson. Any real notice will arrive by post.

What happens next?

McKesson says it's ended the unauthorised access, hired outside forensics specialists, and told law enforcement. Expect state attorneys general and the US Department of Health and Human Services to open their own reviews if protected health information turns out to be in scope. A clearer victim count, and a clearer picture of what ShinyHunters actually holds, will follow in the weeks ahead.