What went down
Hackers breached a third‑party application that McKesson relies on and are actively pulling data. The company filed a notice with the SEC on Friday evening, confirming the intrusion and the ongoing exfiltration.
McKesson’s CTO, Francisco Fraga, warned that customers might notice intermittent service degradation as a side‑effect of the attack. The firm has chosen not to pull the affected systems offline, preferring to keep its supply chain moving.
Who’s behind it
The ShinyHunters cybercriminal group posted a blog entry taking credit for the incident. The FBI has previously flagged ShinyHunters for demanding ransom after stealing data from compromised Salesforce environments, which aligns with the tactics seen here.
Why it matters for the industry
McKesson moves roughly a third of all prescriptions in North America and reported $106 billion in revenue last quarter. Even a brief dip in service can ripple through pharmacies, hospitals, and insurers that depend on its platform.
Technical clues
Details about the compromised third‑party app remain sparse; the filing does not name the software, nor does it list specific vulnerabilities. What is clear is that the attackers achieved privileged access sufficient to export data, suggesting a credential‑theft or token‑theft scenario rather than a classic ransomware lock‑out.
What you can do now
If you integrate with any McKesson‑hosted services, consider these steps:
- Review audit logs for unexpected API calls or data pulls originating from McKesson‑related endpoints.
- Enforce multi‑factor authentication on any credentials that grant access to third‑party integrations.
- Temporarily increase monitoring thresholds for latency or error spikes that could signal downstream degradation.
- Confirm that backup and disaster‑recovery processes are up to date; a rapid rollback can mitigate downstream impact.
- Stay tuned to advisories from both McKesson and the FBI for any ransom‑demand updates or public data‑leak threats.
Keeping an eye on the supply chain and tightening identity controls are the best bets until the breach is fully contained.