McKesson reports cybersecurity incident

IRVING, Texas – McKesson discovered a cybersecurity incident on Aug. 25 affecting its information systems, the company disclosed in a Form 8-K filed with the U.S. Securities and Exchange Commission (SEC).

Based on its investigation thus far, including assessments by leading cybersecurity industry experts, McKesson has confirmed that the unauthorized access to certain third-party applications and the exfiltration of certain data was associated with a subset of customers within its Oncology & Multispecialty and Medical-Surgical business units, according to an Aug. 29 update on its website.

“We have reasonable assurance of no ongoing unauthorized activity in our systems,” the company stated. “Customers can continue to connect to and use our systems and services as intended. We continue to monitor our environment closely and take measures to support the security and reliability of our operations.”

McKesson provided the following next steps:

• The company’s investigation remains ongoing and it continues to fully ascertain the scope of information that may have been accessed or acquired.
• The company will continue to provide updates as additional information becomes available. Any updates about the nature and scope of this incident will come from McKesson and be posted on McKesson.com/cybersecurity.
• The company also expects to provide complimentary credit monitoring and identity protection services, as well as a dedicated information line to answer questions and provide support to partners, customers and their patients whose data was exfiltrated.

“We take the security and privacy of our partners, customers and their patients very seriously,” the company stated. “We appreciate your patience and partnership as our investigation continues.”

The ShinyHunters extortion group told BleepingComputer that it was behind the attack, claiming it gained access after conducting voice phishing – or vishing – social engineering attacks against multiple McKesson employees. The group reportedly demanded a $55.2 million ransom.

• Related: AdaptHealth reports cybersecurity attack.