McKesson said on Aug. 25 that attackers exfiltrated data from third-party applications tied to customers in its Oncology & Multispecialty and Medical-Surgical businesses, while ShinyHunters said it stole and listed 284 million patient records. The company says its distribution and core services are still running, even as the incident moves from disclosure into an extortion and public-release phase.
The apparent path was human-led rather than a direct app break: ShinyHunters told reporters it used phone-based social engineering to steal employee credentials, then entered McKesson through normal single sign-on and cloud app screens. That matters because the access looked legitimate, so the theft could continue through everyday tools without taking down the company’s operations.
For healthcare organizations that keep service up while isolating affected SaaS and integrations, the exposure can still persist in criminal hands after the outage risk is contained. If the stolen data includes patient, billing, and employee records as claimed, the lasting harm is misuse and leak pressure, not just the initial intrusion.
Hackers Frequently Target Healthcare and Finance Orgs | Huntress
Healthcare organizations and banks handle highly personal information. But a new Huntress survey shows many threat actors frequently target these companies.