McKesson Confirms Data Breach as Attacker Deadline Looms

McKesson, a major healthcare company, suffered a significant data breach in which attackers exfiltrated up to 284 million records containing personally identifiable information (PII), protected health information (PHI), and medical data. The ShinyHunters group's ability to access such a vast volume of sensitive records suggests inadequate access controls, insufficient data segmentation, or weak monitoring around critical data repositories. Healthcare organizations are high-value targets precisely because they hold large concentrations of sensitive data with regulatory value and personal harm potential. This incident underscores that even large enterprises with mature security programs can suffer catastrophic data loss if internal controls around sensitive data are not rigorously enforced. The ransom demand of $55 million reflects both the sensitivity of healthcare data and the growing boldness of extortion-focused threat actors.