Threat Intelligence Brief
Curated summary with source attribution
Source: cyberinsider.com
Threat Risk: High
Victim: McKesson
Incident: Unauthorized access and data exfiltration via third-party applications.
Impact: Exposure of sensitive PII and PHI for 284 million patients and associated healthcare providers.
Attacker: ShinyHunters
Analysis: The breach appears to have originated through unauthorized access to third-party applications used by McKesson. The stolen dataset is alarmingly comprehensive, containing not only PII and SSNs but also highly sensitive clinical notes and predictive health assessments. This incident underscores the critical vulnerability of healthcare supply chains when third-party integrations lack rigorous security oversight.
Recommendations: Perform a comprehensive security audit of all third-party application permissions and API integrations.; Implement strict data egress monitoring to detect and block large-scale unauthorized exfiltration.; Increase vigilance for targeted phishing and identity theft attempts among healthcare employees and partners.
Source: CyberInsider
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-08-29 00:15 UTC
Unauthorized access to third-party applications leading to the exfiltration of sensitive patient data. Potential exposure of 284 million patient records and reported intermittent service degradation. The attack leveraged social engineering, specifically vishing, to compromise employee credentials and gain access to third-party applications. The use of deceptive domains like mckesson[.]claims indicates a focused, targeted campaign strategy. This incident highlights the significant risk posed by the compromise of third-party service integrations in the healthcare sector.
Corroborating source: bleepingcomputer.com