McKesson's breach reached 6.4 million people. The company last spoke on 29 August.
The breach at McKesson reached 6.4 million people, citing an analysis by the notification service Have I Been Pwned, The Register reported.
The group calling itself ShinyHunters claimed 284 million documents and demanded 55.2 million dollars, The Register said.
The records include names, email and postal addresses, genders, dates of birth, phone numbers, employer details, appointment dates and notes, and details of the condition being treated. The group also claimed Social Security numbers were involved, although the Have I Been Pwned analysis did not confirm that.
McKesson supports 3,300 oncology providers across 29 states. Its last public update came from its chief information officer and chief technology officer on 29 August 2026. The Register says the company has not publicly confirmed the scale since.
Note what is missing. Twelve days after McKesson's last update, the only published count of who was affected came from outside the company.
Who owns your second disclosure, the one that goes out when the figure changes?
Sources
For your next steering committee
- 1Ask when systems of this kind in your landscape were last patched, and who confirms it.
- 2Ask which finance and ERP accounts can be reached from outside, and how each sign-in is protected.
- 3Ask how long a restore took the last time it was tested.
Issue 01 of the ERP LEADERS brief puts a timeline, the three-number review and six questions on one page. Read issue 01
Welcome back. · Issue 01