Healthcare Giant McKesson Investigates Data Breach Incident

One of America’s largest healthcare distributors is investigating a serious data breach which notorious threat actor ShinyHunters has claimed responsibility for.

Founded in 1833, McKesson provides wholesale medical supplies and pharmaceutical distribution to over 40,000 corporate and institutional customers.

However, the firm revealed in a statement on August 28 that it was investigating an incident “involving third-party applications and unauthorized access and exfiltration of data.”

The most recent update, published a day later, confirmed the breach.

“Based on our investigation thus far, including assessments by leading cybersecurity industry experts supporting our response, we’ve confirmed that the unauthorized access to certain third-party applications and the exfiltration of certain data was associated with a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units,” it explained.

Read more on healthcare incidents: Boston Scientific Reveals Global Disruption After Cyber Incident.

McKesson was at pains to point out that customer service is unaffected, despite initially warning on Friday that “customers may experience intermittent service degradation that we believe may be related to this incident.”

The most recent statement claimed that, although the investigation continues, there is no ongoing unauthorized activity in the corporate network and customers can still use its services as normal.

“McKesson continues to serve customers across all our lines of business and accept orders,” it added. “Our distribution centers remain operational, and we continue to ship products across our distribution network.”

ShinyHunters Claims Responsibility

Data extortion specialists ShinyHunters posted an entry for the firm on their leak site, claiming to have compromised hundreds of millions of records.

Reports suggest as many as 284 million records may have been compromised, with McKesson hit with a $55m ransom demand. It’s believed the threat actors targeted employees with social engineering to gain initial access.

Black Hills Information Security owner, John Strand, argued that the incident highlights the challenge of securing third-party application environments.

“The more third-party vendors you integrate with, especially SaaS providers, the larger your attack surface becomes. Every integration, API, application, and vendor relationship creates another potential path into your organization,” he explained.

“I also don’t think enough is being done around supply-chain security. Organizations should be asking harder questions of their SaaS providers, getting letters of attestation, understanding how these services are secured, and identifying exactly what access those vendors have to their environments.”

The incident comes just days after another critical player in America’s healthcare supply chain was breached.

Medtech giant Boston Scientific revealed in an SEC Form 8-K filing that the incident had caused “global disruption.”

Image credit: JHVEPhoto / Shutterstock.com