Emerging ThreatsData Breaches

ShinyHunters Breach Exposes 6.4M in McKesson Cyberattack

Analyst 207||Source: TheRegister
Hospital corridor with people walking and sitting, medical devices in background.

"The impacted data related to a range of individuals and roles, including marketing campaign recipients, patients, staff, and healthcare provider contacts." — Have I Been Pwned (HIBP)

Have I Been Pwned: 6.4 million individuals identified

Have I Been Pwned (HIBP) published an assessment this week that places the scale of the McKesson incident at roughly 6.4 million affected individuals. That figure comes from HIBP's analysis of data leaked by the extortion group ShinyHunters and represents the first public estimate of the number of people whose records appeared in the published corpus.

What types of information appeared in the leaked corpus

According to HIBP, the exposed records vary by individual but collectively include names, email and physical addresses, gender, dates of birth, phone numbers, employer details, and sensitive health information. HIBP's characterization aligns broadly with ShinyHunters' claims that the theft included appointment dates and notes and specific medical details — the extortionists asserted the data contained such items as locations of patients' cancers.

ShinyHunters also claimed to have stolen Social Security numbers (SSNs) as part of the breach; HIBP's analysis, however, did not include SSNs in the leaked corpus it examined.

ShinyHunters' claims and the extortion demand

ShinyHunters first claimed in August to have taken 284 million documents from McKesson. The group told The Register it issued a $55.2 million extortion demand to prevent release of the files. The subsequent publication of data indicates the ransom demand was not paid.

McKesson's posture and its oncology network

McKesson has not publicly confirmed the full scale of the breach or provided additional detail since an update from its CIO and CTO on August 29. The company supports 3,300 oncology providers in 29 states — a fact that underscores the potential breadth of clinical contacts and patients connected to McKesson's services.

While McKesson itself has remained limited in public comment since the late-August update, HIBP reports that McKesson is informing the millions of individuals affected by the breach.

Parallel incidents: Boston Scientific and Veradigm

The McKesson disclosure comes amid separate, contemporaneous incidents affecting other healthcare and health-technology companies. Medical device maker Boston Scientific disclosed a cyberattack at around the same time; its public disclosures to shareholders said the disruption would lead it to miss sales and earnings guidance for the third quarter. Boston Scientific later reported manufacturing, order fulfillment, and shipping operations had been fully restored, with work on some business applications still ongoing.

Healthtech company Veradigm also disclosed a cyberattack to U.S. regulators after ransomware group The Gentlemen claimed responsibility. Veradigm said attackers obtained credentials from a third-party vendor environment and used them to access a company API, stealing patient data without disrupting operations. The Gentlemen claimed to have taken roughly 3.5 million records containing personally identifiable information, including SSNs.

What this means for patients, oncology providers, and security teams

  • Patients and individuals named in the leak: HIBP's analysis indicates millions have some form of personal and sensitive health data exposed. McKesson is notifying affected individuals, according to HIBP, but the presence of sensitive clinical details in the published corpus raises risks of privacy harm and potential exploitation for secondary fraud.
  • Oncology providers that rely on McKesson: With McKesson supporting 3,300 oncology providers in 29 states, providers are likely to be tracking incident status and communications closely; the presence of appointment notes, dates, and clinical specifics in the leak can affect provider-patient confidentiality and clinical workflows.
  • Security teams and third-party vendors: The Veradigm incident highlights credential theft from a third-party vendor as a vector. Security teams supporting healthcare firms and vendors will be watching whether stolen credentials or API access are recurring patterns across these contemporaneous intrusions.

The record published by ShinyHunters and HIBP's subsequent tally leave two clear facts in view: a public estimate of roughly 6.4 million affected individuals, and an unresolved discrepancy over the presence of SSNs — claimed by the extortionists but not included in HIBP's analysis. McKesson's limited public commentary since August 29 and the $55.2 million extortion demand reported by ShinyHunters frame the incident as both a significant data exposure and an episode in an ongoing pattern of healthcare-related cyber intrusions. Observers and those affected will be watching for further public confirmation from McKesson and any regulator filings that detail the scope and content of the records that were leaked.

Source: The Register — ShinyHunters expose 6.4M in attack on medical supplier McKesson

Data BreachEmerging ThreatsGdprHealthcareNation-StateRansomwareShinyhuntersSupply ChainPersonal Data ExposureMckesson
Related Intelligence

Continue Reading

Abandoned office cubicle with open laptop and scattered papers amidst tidy workstations.

Identity Theft Dominates 4 Key Threat Patterns

Malicious hackers targeted identities in nearly half of all confirmed attacks, with session hijacking and replay emerging as the most effective tactics for gaining unauthorized account access. This alarming trend highlights the growing threat of identity theft in today's digital landscape.

Analyst 207
Windows laptop on cluttered office desk with Chrome browser open.

BlueMoon Exploit Kit Targets Windows, Chrome with Zero-Day Flaws

Meet BlueMoon, a sneaky exploit kit that's been wreaking havoc on Windows and Chrome since August 28, using not one, not two, but three zero-day flaws to do its dirty work. This malicious tool, linked to the JungleBamboo threat actor, combines browser vulnerabilities with a Windows kernel exploit to gain ultimate control.

Analyst 207
Person sits at office desk with smartphone, surrounded by equipment and daylight from a blurred cityscape outside.

Gigabud Trojan Exploits Android Work Profiles to Evade Banking App Malware Checks

The sneaky Gigabud Trojan is exploiting Android work profiles to slip past banking app security checks, allowing it to secretly tamper with transactions and drain accounts. By creating a separate work profile, Gigabud can hide in plain sight and facilitate fraudulent payments that appear legitimate.

Analyst 207
Empty office print room with multifunction printers and scattered papers.

AI Agents Fuel PaperCut Attacks at Scale

A suspected Russian-speaking actor has unleashed a massive assault on PaperCut MF/NG, compromising at least 440 instances with the help of hundreds of AI agents that supercharged exploit development, targeting, and post-exploit operations. The attacks hit the education sector hard, with victims in 48 countries, primarily in the US, UK, France, and other major nations.

Analyst 207