Two major healthcare companies, Boston Scientific and McKesson, have recently disclosed details regarding separate cyberattacks that have impacted their operations and patient data. Boston Scientific, a medical device manufacturer, reported an ongoing cyberattack affecting its IT systems, while pharmaceutical and medical supply giant McKesson confirmed an intrusion with data exfiltration, for which the ShinyHunters group has claimed responsibility.
Boston Scientific's IT systems were compromised by unknown intruders, with the attack first detected on August 25. The company stated that the incident has disrupted manufacturing, shipping, and ordering processes. Crucially, the attack has also affected remote monitoring capabilities for pacemakers and other heart devices implanted after August 25. New remote monitoring communicators for cardiac rhythm management implants, excluding insertable cardiac monitors (ICM), cannot be activated, preventing data transmission to remote patient management systems.
For new ICM devices, the Boston Scientific Clinic Assistant app is required for activation to ensure correct heart rhythm recording. However, due to the cyberattack, new ICMs are unable to pair with patient remote monitoring mobile phones, meaning episode data will not be transmitted to remote monitoring systems until pairing is restored. Patients can still record episodes, and data can be transmitted in-person using the Clinic Assistant app's "interrogate" button. The company has not provided a timeline for full restoration of affected functions and systems, though it is working towards partial restoration for shipping some products this week. Boston Scientific has engaged CrowdStrike to assist with the investigation and recovery, and has confirmed that only certain on-premise systems were affected, with no indication of unauthorized activity since August 25. The company has not specified whether the incident was a ransomware attack or identified the responsible group.
In a separate incident, McKesson confirmed an intrusion that resulted in unauthorized access to certain third-party applications and the exfiltration of data. The ShinyHunters extortion group claimed responsibility, stating they breached McKesson's Snowflake and Salesforce instances. McKesson's Executive VP and CIO/CTO, Francisco Fraga, confirmed that the unauthorized access and data exfiltration were associated with a subset of customers within their Oncology & Multispecialty and Medical-Surgical business units. The company has not disclosed the number of affected patients or the specific types of data stolen, but stated that distribution centers remain operational. McKesson believes the intruders have been removed from the third-party environments.
ShinyHunters claims to have compromised over 284 million patient records and is demanding $55.2 million from McKesson to prevent the leak of the stolen data. The group alleges the stolen data includes full names, home and email addresses, phone numbers, dates of birth, Social Security numbers, appointment dates and notes, and sensitive illness details such as cancer locations. They also claim to have obtained emails containing private information exchanged between doctors and patients. ShinyHunters stated they gained access through voice phishing multiple employees, a method they have reportedly used in other recent attacks against healthcare providers, including Medtronic in April and Exact Sciences in July. However, it is important to note that claims made by criminal groups regarding the scale of breaches should be viewed with caution, as they can sometimes be exaggerated.
