Circuit Wire — a daily news update from the Circuit.
McKesson, one of the largest US healthcare and pharmaceutical distributors, disclosed on Friday, August 28, that intruders reached third-party applications and stole company data, according to BleepingComputer. The ShinyHunters extortion group claimed it had taken roughly 284 million patient-related records.
The company said it discovered the incident on August 25 and reported it in a Form 8-K filing with the Securities and Exchange Commission. McKesson said its investigation is in the early stages and that it has not determined the breach to be material. It warned customers that they may see intermittent service degradation linked to the attack.
ShinyHunters told BleepingComputer it gained access through voice phishing, calling several McKesson employees and persuading them to hand over credentials. The group said the calls compromised Okta single sign-on accounts, which it then used to reach the company's Salesforce and Snowflake environments. It claimed to have removed about one terabyte of data over four days, between August 21 and 25.
The group said the stolen records include names, addresses, dates of birth, Social Security numbers, medical record numbers, and medication and allergy details. It clarified that 284 million is a raw count of records rather than a tally of unique patients. ShinyHunters said it demanded a ransom of about 55 million dollars and gave McKesson 72 hours to respond. The company did not negotiate, according to the group, and BleepingComputer said it could not independently verify the claims.
The breach fits a widening run of ShinyHunters attacks on healthcare and health-technology firms, with recent targets including Medtronic, DentaQuest and iRhythm. Researchers at ReliaQuest have tracked the group registering lookalike web domains that pair a company name with a .claims ending to impersonate corporate help desks. In this case, investigators tied the domain mckesson[.]claims to the campaign.
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.