McKesson, a major healthcare sector vendor, has confirmed a cyberattack that resulted in data theft and temporary service disruptions. The company disclosed on Friday, August 29, that attackers gained unauthorized access to some of its third-party applications and exfiltrated data belonging to a subset of customers in its oncology, multispecialty, and medical-surgical business units.
The incident was discovered on August 25, with the period of unauthorized access and data theft occurring over four days, from August 21 to August 25. McKesson's Chief Information and Technology Officer, Francisco Fraga, stated that the company immediately activated its incident response protocols, launched an investigation, and engaged leading cybersecurity experts. Fraga affirmed that McKesson has reasonable assurance of no ongoing unauthorized activity in its systems and that business and distribution centers remain operational.
While McKesson has not identified the perpetrators, the cybercrime group ShinyHunters has claimed responsibility for the attack. The group added McKesson to its data-leak site on Friday, August 29, the same day McKesson filed a regulatory disclosure about the incident. ShinyHunters is reportedly demanding a ransom in excess of $55 million, with a deadline of September 1. McKesson has not commented on the ransom demand or whether it has engaged with the alleged attackers.
ShinyHunters is known for targeting large organizations with extortion demands following the theft of sensitive data. The group typically employs social engineering or exploits identity weaknesses to gain access to cloud-hosted environments. These attacks often occur within vendor-hosted environments using valid, socially-engineered credentials, making them difficult to detect early as they mimic normal support or data-warehouse tasks and do not trigger traditional malware alerts. Organizations often remain unaware of a breach until the extortionists make contact.
The circumstances of the attack on McKesson are consistent with other recent ShinyHunters incidents. The group has been linked to compromises of major cloud platforms, including Oracle, Salesforce, and Snowflake. Last summer, ShinyHunters was also connected to an extensive compromise affecting hundreds of Salesloft Drift customers.
In April, ShinyHunters breached the systems of Canvas, a platform for K-12 and university coursework, leading to widespread outages and data theft. After an initial deadline passed without payment, ShinyHunters escalated pressure by defacing the platform's login pages with an extortion message. Instructure, the company behind Canvas, ultimately reached an agreement with the cybercriminals, stating that the stolen data was returned with assurances that other copies were destroyed.
Days after the Canvas incident, the FBI issued a public service announcement warning potential victims about ShinyHunters' pressure tactics and claims. In late July, less than a month before the McKesson attack, Health-ISAC also warned organizations in the healthcare sector about an increase in successful attacks by ShinyHunters. McKesson, which distributes approximately one-third of all pharmaceuticals in North America and reported $403.4 billion in revenue for the year ending in March, represents a high-profile target for cybercriminals.
