McKesson Data Breach: Patients’ Personal and Health Information May Be at Risk Featured
McKesson is investigating an August 2026 cybersecurity incident involving unauthorized access to third-party applications and the exfiltration of data.
McKesson Corporation is investigating a major cybersecurity incident that may have exposed sensitive information. The company discovered the incident on August 25, 2026 and disclosed it publicly on August 28, 2026.
McKesson has confirmed that unauthorized actors accessed third-party applications and removed data. However, the investigation is still ongoing. The company has not yet disclosed the total number of people affected or all of the information involved.
What Happened in the McKesson Data Breach?
McKesson is one of the largest healthcare and pharmaceutical services companies in the United States. Its businesses handle information connected with patients, pharmacies, healthcare providers, insurers, and prescription services.
According to McKesson, unauthorized individuals gained access to third-party applications and exfiltrated data. The company has engaged cybersecurity specialists to investigate the incident.
At this time, McKesson has not publicly identified every affected application or business unit.
How Many People May Be Affected?
The hacking group known as ShinyHunters has reportedly claimed responsibility for the McKesson data breach.
The group claims that approximately one terabyte of data was taken. It has also claimed that the stolen information contained about 284 million patient-related database records.
However, this does not mean that 284 million people were affected. The number refers to database records or rows, not confirmed individual victims.
McKesson has not confirmed the hackers’ figures.
What Information May Have Been Exposed?
ShinyHunters has reportedly claimed that the stolen information may include combinations of:
- Names
- Addresses
- Dates of birth
- Social Security numbers
- Telephone numbers
- Email addresses
- Patient identifiers
- Medicaid information
- Medical-record numbers
- Prescription information
- Medications
- Allergies
- Illness information
- Physician information
- Appointments
- Medication shipments
- Healthcare provider information
Importantly, McKesson has not yet confirmed that all of these types of information were exposed.
The company is continuing its investigation. Therefore, the exact information involved may differ from person to person.
Why Is This Data Breach Serious?
Healthcare information can be especially valuable to criminals. Unlike a password or credit card number, some personal information cannot easily be changed.
For example, a Social Security number, date of birth, medical history, or prescription history may remain useful to criminals for years.
If sensitive information was stolen, affected individuals could face an increased risk of:
- Identity theft
- Medical identity theft
- Insurance fraud
- Prescription fraud
- Account takeover
- Targeted phishing scams
- Impersonation
As a result, affected individuals should watch for unusual activity involving their financial, medical, insurance, and prescription accounts.
McKesson, CoverMyMeds and Pharmacy Technology
McKesson operates extensive healthcare and pharmacy technology businesses. The company also owns CoverMyMeds, which provides electronic prescription and prior-authorization services.
McKesson also provides pharmacy-management technology through products such as EnterpriseRx.
However, McKesson has not publicly confirmed that CoverMyMeds, EnterpriseRx, or any particular McKesson platform was affected by this incident.
That determination remains part of the ongoing investigation.
Were You Affected by the McKesson Data Breach?
If you received a data breach notification from McKesson, we would like to hear from you.
You may also contact us if you believe McKesson or a McKesson-related service maintained your personal, prescription, or healthcare information.
Complete the form below to learn more about the investigation and your potential legal rights.
There is no cost or obligation to submit the form.
Submitting the form does not create an attorney-client relationship.