ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “mckesson”

110 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllRansomware 41Policy & legal 14Vulnerability 12Data breach 11Malware 9Industry 7Threat actor 6Phishing & fraud 4Exploit / PoC 4AI tools & infra 1AI policy 1
SeverityAllcritical 73high 17medium 3low 1info 16

McKesson copes with fallout from data theft extortion attack

McKesson discloses a data theft extortion attack by ShinyHunters affecting oncology and medical-surgical customers, with a reported $55 million demand.

McKesson disclosed that attackers gained access to some of its third-party applications and stole data associated with a subset of customers in its oncology, multispecialty, and medical-surgical business units; the intrusion ran for four days from August 21 and was discovered August 25. ShinyHunters claimed responsibility and listed McKesson on its data-leak site, reportedly demanding more than $55 million with a September 1 deadline. Flashpoint analysts say the group typically uses social engineering and identity weaknesses with valid credentials to access cloud-hosted environments, making the intrusion hard to detect. McKesson, which distributes about one-third of pharmaceuticals used in North America with $403.4 billion in annual revenue, says operations continue and it has reasonable assurance of no ongoing unauthorized activity.

CyberScoop · 15d agoData breach in the wild

ShinyHunters claims it stole 284 million patient records from McKesson

ShinyHunters claims theft of 284 million patient records from McKesson via vishing, Okta takeover, and Salesforce/Snowflake access, demanding $55,236,150.

McKesson disclosed in an SEC filing a cybersecurity incident detected August 25, 2026, involving unauthorized access to third-party applications and data exfiltration affecting a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units. ShinyHunters told BleepingComputer it entered through vishing calls to employees, used stolen credentials to take over Okta single sign-on accounts, and extracted about a terabyte of data from Salesforce and Snowflake environments over four days. The group claims 284 million database rows including names, addresses, Social Security numbers, Medicaid details, medical record numbers, and medication data, and demanded $55,236,150 with a 72-hour deadline; none of these claims have been independently verified.

Help Net Security · 15d agoData breach

Pharmaceutical giant McKesson warns of 'service degradation' following cyberattack

Pharmaceutical giant McKesson disclosed a cyberattack on a third-party application that exfiltrated customer data, claimed by ShinyHunters.

McKesson reported a cybersecurity incident involving an unnamed third-party application, with attackers exfiltrating data tied to its oncology and surgical business units. The company filed with the SEC, offered credit monitoring, and said it had received reasonable assurance the attackers were no longer inside its systems. The ShinyHunters group claimed responsibility and threatened leaks; McKesson reported $106 billion in revenue last quarter and distributes about one-third of North American prescriptions.

The Record · 15d agoRansomware in the wild

ShinyHunters expose 6.4M in attack on medical supplier McKesson

ShinyHunters leaked stolen McKesson data exposing roughly 6.4 million individuals after the medical supplier reportedly declined a $55.2 million extortion demand.

Have I Been Pwned added records leaked by ShinyHunters from medical and pharmaceutical supply company McKesson, confirming the August 2026 attack affected about 6.4 million people. Exposed data includes names, email and physical addresses, dates of birth, phone numbers, employer details, and sensitive health information; ShinyHunters claimed SSNs and 284 million documents were taken, though HIBP found no SSNs. The group issued a $55.2 million extortion demand that was apparently unpaid before publication. The article also notes Boston Scientific expects to miss Q3 guidance after its own attack, and that Veradigm disclosed attackers used third-party vendor credentials to access an API and steal roughly 3.5 million patient records claimed by ransomware group The Gentlemen.

The Register · Security · 5d agoData breach 4 sources

ShinyHunters expose 6.4M in attack on medical supplier McKesson

Have I Been Pwned data shows ShinyHunters' attack on medical supplier McKesson exposed records of roughly 6.4 million individuals.

Have I Been Pwned added data from the McKesson breach, revealing that last month's cyberattack at the medical and pharmaceutical supply company affected roughly 6.4 million individuals. The extortion group ShinyHunters initially claimed to have stolen 284 million documents from McKesson. HIBP's addition of the ShinyHunters-leaked data is the first public indication of the attack's true scale.

DataBreaches.net · 5d agoData breach in the wild

Healthcare Giant McKesson Investigates Data Breach Incident

ShinyHunters claims theft of 284 million records from healthcare giant McKesson, which says it is investigating the alleged breach.

ShinyHunters claims it stole 284 million records from McKesson, one of the largest healthcare distribution companies. McKesson confirmed it is investigating a data breach incident. The claimed scale of the theft has not yet been independently verified, and extortion activity is implied by the actor's involvement.

Infosecurity Magazine · 14d agoData breach

McKesson confirms cyber incident after ShinyHunters claims patient-data theft

Healthcare giant McKesson confirmed a cyber incident after ShinyHunters claimed theft of hundreds of millions of patient records.

McKesson acknowledged a data breach following public claims by the threat actor group ShinyHunters that it stole hundreds of millions of records containing patient data. The company confirmed a cyber incident occurred but the full scope of the theft has not yet been independently verified. ShinyHunters is known for large-scale data theft and extortion against major organizations. The healthcare sector remains a frequent target for data-theft extortion groups.

Malwarebytes Labs · 15d agoData breach

Hackers claim millions of patient records stolen during data breach at healthcare giant McKesson

Hackers claim theft of millions of patient records from US healthcare distributor McKesson, which confirmed a hack and expects service degradation.

McKesson, which distributes medicines and medical devices to hospitals and healthcare practices across the US, said it was hacked. Threat actors claim millions of patient records were stolen in the breach. The company said it expects intermittent service degradation as it responds to the incident.

TechCrunch · Security · 15d agoData breach in the wild

The story behind the intelligence

Cisco Talos newsletter features adversary-engagement podcast, flags AI guardrail 'safety penalty' slowing defenders, and recaps McKesson breach and PaperCut patching headlines.

The Threat Source newsletter spotlights the Beers with Talos podcast, in which researcher Azim Khodjibaev describes maintaining eight dark-web personas to identify prolific cybercriminals and support disruption efforts. Talos also argues frontier AI guardrails impose an AI 'safety penalty', citing a July 2026 incident where Hugging Face's primary cloud LLM refused to analyze forensic breach data and delayed response. Recapped headlines include ShinyHunters claiming theft of 284 million patient records from McKesson via vishing and Okta account takeover, Anthropic warning Claude users about infostealer malware, and PaperCut issuing emergency patches for chained vulnerabilities.

Cisco Talos · 12d agoIndustry

Risky Bulletin: Dutch intel services to get extensive new powers

Netherlands proposed a bill granting AIVD and MIVD expanded warrantless tapping, faster hacking powers, and forced data disclosure, citing Russia, China, and Iran threats.

The Dutch government introduced a bill greatly expanding surveillance powers of intelligence agencies AIVD and MIVD, allowing up to one year of tapping without pre-approval and simplified hacking operations against 'foreign adversaries'. Agencies could compel Dutch companies or citizens to provide data under threat of charges, share data with the private sector, and oversight bodies would merge into a new CTT board. The bill follows similar overhauls in Ireland, Germany, and France after Russia's invasion of Ukraine. The newsletter also reports Moonwell hacked for $8.7M, a Cosmos EVM bug exploited for ~$3M, ShinyHunters listing McKesson with claimed hundreds of millions of records, and a pro-Kremlin DDoS claim against Norway's government network.

Risky Business News · 15d agoPolicy & legal

Healthcare cyberattacks hit pacemakers and millions of patient records

McKesson confirms a data breach as ShinyHunters demands $55.2M amid healthcare cyberattacks affecting millions of patient records and pacemaker devices.

McKesson, one of the largest US healthcare distribution companies, has admitted a data breach. The ShinyHunters group is demanding a $55.2M extortion payment. The Register reports broader healthcare cyberattacks tied to the story, affecting millions of patient records and involving medical devices such as pacemakers. Details on the exact number of compromised records have not been confirmed.

The Register · Security · 15d agoData breach in the wild

Nutex Health Says Patient Data Stolen, Hackers Threaten Leak

The Gentlemen ransomware gang claims breach of US healthcare provider Nutex Health, exfiltrating patient and employee data and threatening publication.

Nutex Health disclosed in an SEC 8-K filing that an unauthorized third party accessed and exfiltrated patient, employee, credentialed provider, business, and financial data from company servers, and threatened to publish it. The Gentlemen ransomware group listed Nutex on its leak site; a class action was filed August 27 and Edelson Lechtzin LLP is separately investigating. Nutex operates over 27 facilities in 12 states and served nearly 100,000 patients in the first half of 2026, with no material operational impact identified so far.

Infosecurity Magazine · 13d agoRansomware

Florida says motor vehicle data breach tied to credentials stolen from officer’s personal device

ShinyHunters breached Florida's DMV using credentials stolen from a police officer's personal device; the state confirmed the breach and is investigating.

Florida's Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed a data breach after ShinyHunters obtained DMV data using credentials a criminal actor took from a Plant City police officer's personal electronic device. The department learned of the breach on September 4, is investigating with the Florida Digital Service, and ShinyHunters shared a DMV record of Jeffrey Epstein as proof of access. Experts initially speculated a link to the IDScan breach of 153 million driver's licenses. Anthropic reported that suspected ShinyHunters affiliates use AI to scan credentials, map systems, and exfiltrate data, in one case moving from a stolen developer token to cloud admin access in about three hours.

The Record · 4d agoData breach in the wild 3 sources

AdaptHealth confirms 4.1 million people exposed in July cyberattack

AdaptHealth confirmed a ShinyHunters-attributed cyberattack exposed data of 4.1 million patients via a compromised third-party contractor account.

Healthcare company AdaptHealth confirmed 4,115,802 individuals were exposed in an intrusion first disclosed in an SEC filing on July 2, 2026, with the compromise beginning June 5. Attackers used social engineering to compromise a privileged third-party contractor account, accessed cloud-based patient management, document storage and EHR portals, and exfiltrated names, contact details, demographic, insurance and health information before a June 15 ransom demand. The attack was attributed to the ShinyHunters group, though the company no longer appears on the gang's extortion portal. Impacted individuals are being offered 12 months of free credit monitoring and identity protection.

BleepingComputerupdated · 5d agofirst · 6d agoData breach 2 sources1

FBI cyber chief worries private sector not sharing enough cyber threat information

FBI cyber chief Brett Leatherman urged companies to share breach information with the bureau as it publishes a victim-focused cyber strategy.

FBI Cyber Division assistant director Brett Leatherman said at the Billington CyberSecurity Summit that private-sector hesitancy to engage the FBI stems from misconceptions, including a belief that shared incident data is passed to regulators. He warned that organizations breached by PRC nation-state actors risk more by handling intrusions alone, since FBI involvement speeds eradication. The bureau published a new cyber strategy Wednesday emphasizing victim aid, adopting a 'share until it hurts' posture on releasing threat intelligence.

CyberScoop · 6d agoPolicy & legal

FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

FBI officials said AI is accelerating adversary capabilities while its new cyber strategy emphasizes continuous patching, cyber hygiene, and AI-enabled defense.

At the Billington CyberSecurity Summit and ahead of a new FBI cyber strategy, deputy assistant director Jason Bilnoski said AI is boosting the speed and capability of both criminal and nation-state attackers, while stressing that basic controls like MFA would still prevent most attacks. Colleen Ferranti urged a shift from quarterly Patch Tuesday cycles to continuous, risk-based patching as AI accelerates vulnerability discovery. The strategy pledges AI-enabled triage, malware analysis, attribution support, agentic AI adoption, expanded Computer Network Operations, ICS Coordinators in every field office, and a pledge on victim relief and privacy.

CyberScoop · 6d agoPolicy & legal

Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

Microsoft patches 974 flaws in record Patch Tuesday, including two actively exploited Windows zero-days enabling privilege escalation.

Microsoft's largest-ever Patch Tuesday addresses 974 vulnerabilities, with CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (Windows Advanced Local Procedure Call) exploited before disclosure. Both zero-days carry CVSS 7.8 ratings and allow privilege escalation. More than 10% of the defects are rated critical, and researchers attribute the record volume to AI-assisted vulnerability discovery without a matching rise in active exploitation.

CyberScoopupdated · 6d agofirst · 7d agoExploit / PoC in the wild 2 sourcesCVE-2026-81963CVE-2026-85880

Feds accuse China of ‘systematic’ distillation of U.S. AI models

NSA, CISA, and FBI jointly accuse Chinese AI firms including DeepSeek and Moonshot AI of industrial-scale distillation of US frontier models.

A joint advisory from the NSA, CISA, and FBI alleges China-based AI companies including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI have systematically extracted capabilities from US frontier models since at least late 2024. The companies allegedly spent billions of tokens across millions of requests against Claude, ChatGPT, Gemini, and Grok, routing traffic through multiple accounts, platforms, proxies, and third-party aggregators to evade detection. Moonshot AI allegedly distilled 18 US models, including Anthropic's most advanced model, to train its Kimi-K2 and Kimi K3 models.

CyberScoop · 7d agoAI policy

Russian national extradited to US for alleged involvement in bank-account takeover scheme

US extradited Russian national Sergei Filimonov over a bank-account takeover scheme using spoofed bank domains that defrauded two banks of $6.3 million.

US authorities extradited 36-year-old Russian national Sergei Anatolyevich Filimonov from the Republic of Georgia on charges including bank and wire fraud conspiracy and aggravated identity theft. He and unnamed co-conspirators allegedly ran spoofed bank domains, bought sponsored links to lure victims, and harvested over 5,000 victim login credentials starting in November 2023, causing unauthorized transfers of about $5.58 million and $735,000 from two banks in 2024. The FBI previously identified at least 19 US victims linked to the credential-storage domain, with roughly $28 million in attempted losses including $14.6 million confirmed. Filimonov faces up to 175 years in prison, pleaded not guilty on September 4, and remains detained in the Northern District of Georgia.

CyberScoop · 7d agoPolicy & legal

CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

CIA deputy director says cyber operations built the intelligence picture enabling US forces to capture Nicolás Maduro in Operation Absolute Resolve.

CIA Deputy Director Michael Ellis said at the Billington Cybersecurity Conference that cyber operations built the intelligence picture that let US special operations forces locate and apprehend Nicolás Maduro within four minutes of landing during Operation Absolute Resolve. He cited the elevation of the Center for Cyber Intelligence to a full mission center as key to aligning resources around the cyber mission. The agency also created a Directorate of Mission Systems and cut its technology acquisition cycle from two to three years to a six-month target, completing more than 400 purchases within that period. Ellis said AI brings unprecedented speed and scale to cyber operations and analysis.

CyberScoop · 7d agoPolicy & legal 2 sources

In most cities, nobody owns the whole network

Former Waco CIO argues cellular-connected water controllers sit outside scanned networks, and accountability plus operating-budget funding—not technology—block segmentation.

Writing as Waco, Texas's former CIO, the author describes July water-sector intrusions that CISA linked to over 100 compromised systems, typically controllers on public cellular links absent from asset lists. The FBI and EPA reported incidents at utilities in at least seven states since July 27, and a Clayton County, Georgia pump station failure triggered a boil-water advisory. He argues accountability and funding—using mechanisms like the Texas Water Development Board's new cybersecurity scoring criteria—are the binding constraints, citing Waco's 43-day segmentation of five treatment plants with operating funds.

CyberScoop · 7d agoIndustry in the wild

New CISO appointments 2026

Companies including Mistral AI, Trellix, Marriott, and ANZ appointed new CISOs in July-September 2026 amid high security-leadership turnover.

CSO Online's rolling column tracks senior security appointments, noting many companies are hiring a CSO/CISO for the first time. Notable moves include Thomas Coudray leaving Ledger to become Mistral AI's CISO, David Soto joining Trellix from Amazon, and Daniel Dubowski becoming Marriott International's SVP and CISO. Other appointments span ANZ, Gigamon, Axonius, Tricentis, Remitly, Allied Universal, and the State of California.

CSO Online · 8d agoIndustry

European parliament members call for slowdown of Serbia’s EU entry over spyware use

29 MEPs urge delaying Serbia's EU accession after researchers found Pegasus and NoviSpy spyware on student activists' phones.

Twenty-nine Members of the European Parliament sent a letter Friday demanding Serbia's EU accession be slowed until an investigation into its spyware use is completed. The letter follows a SHARE Foundation report, with Amnesty International and the Citizen Lab, documenting Pegasus and NoviSpy infections on Serbian student activists' phones; NoviSpy evidence pointed to Serbian government authorities, though Pegasus attribution was not assigned. The MEPs also urged European Commission President Ursula von der Leyen to cancel a planned visit to Serbia and called the surveillance 'a direct state attack on democracy' ahead of upcoming elections. The Serbian government did not respond to requests for comment.

CyberScoop · 11d agoPolicy & legal in the wild

Why judgment is emerging as cybersecurity’s defining skill

CyberScoop op-ed argues CISOs should grant AI autonomy based on reversibility and blast radius rather than model confidence, and measure analyst overrides of AI recommendations.

A CyberScoop op-ed contends that as AI takes over analysis and recommendations in security operations, human judgment about context, reversibility and blast radius becomes the defining skill. The author argues autonomy decisions should rest on how reversible and impactful an action is rather than model confidence, citing examples such as patching vendor-certified medical devices and a service account whose 3 a.m. login spikes were normal quarterly-close activity. It also urges leaders to measure analyst approvals, edits and rejections of AI recommendations, and review latency, instead of automation rates or mean time to resolution.

CyberScoop · 11d agoIndustry

Attackers exploit zero-days in consistently besieged SonicWall product

Two actively exploited SonicWall SMA 1000 zero-days chain to unauthenticated RCE; patches released and CISA added both to KEV.

SonicWall disclosed and patched two zero-days in SMA 1000 appliances: CVE-2026-83548, a maximum-severity pre-authentication SSRF, and CVE-2026-83549, a high-severity OS command injection. Rapid7 said chaining the flaws yields unauthenticated remote code execution, and CISA added both to its KEV catalog Wednesday. The vendor provided no IOCs or victim counts, urging customers to hunt for compromise, reimage or redeploy appliances, and reset all passwords and tokens. The product has faced repeated exploitation, including ransomware-linked flaws used by INC and Akira.

CyberScoop · 12d agoExploit / PoC in the wildCVE-2026-83548CVE-2026-83549

The G7 tells industry to hurry up and prep for post-quantum encryption

A G7 working group report urges governments and industry to accelerate post-quantum cryptography migration, framing quantum risk as a near-term economic threat.

A cybersecurity working group formed at the June 2026 G7 Summit in France called on organizations to stop postponing migration of critical systems to post-quantum cryptography, warning that harvest-now-decrypt-later attacks against currently encrypted data exist today. The report was signed by CISA, the UK NCSC, France's ANSSI, Germany's BSI, Canada's CSE, Japan's NCO, and Italy's ACN. It also cautions that some NIST-selected PQC algorithms have already been broken on classical computers, reinforcing support for crypto-agility. The push aligns with a recent US executive order moving federal PQC migration timelines from 2035 to 2030, while Google and others target 2029.

CyberScoop · 12d agoPolicy & legal

Jail time for Maine child in 764 marks turning point in federal law enforcement

A 17-year-old from Maine became the first minor federally adjudicated for 764 extremist crimes, including child exploitation, signaling a policy shift on prosecuting juveniles.

The FBI said a Maine teenager is the first child federally charged and adjudicated for crimes tied to the nihilistic violent extremist collective 764, part of The Com network. Charges include conspiracy to sexually exploit a child, distributing CSAM, interstate threats, cyberstalking, and identity theft. The case marks a turning point in federal policy on prosecuting juveniles and continues heightened enforcement: Kyle Spitze was sentenced to 77 years and Alexis Chavez to 40 years in related cases. The FBI is investigating more than 500 subjects connected to 764 and its offshoots nationwide.

CyberScoop · 13d agoPolicy & legal

FCC proposes public scorecard to rate telecoms on anti-robocall efforts

The FCC proposed a public scorecard rating telecoms' anti-robocall effectiveness and removed 14 providers from US networks for compliance failures.

The Federal Communications Commission issued a public notice proposing a scorecard that would assess how effectively retail voice providers, including wireless, wireline and VoIP, prevent illegal robocalls, drawing on Robocall Mitigation Database filings, consumer complaint and enforcement data. The agency stressed it is not a rulemaking imposing new requirements, and it is seeking comment on scope, such as whether to focus on larger providers. The same day, the FCC removed 14 providers from the Robocall Mitigation Database for non-compliance, effectively requiring other US providers to block their traffic within two days.

CyberScoop · 13d agoPolicy & legal

Health data of more than 9.5 million people leaked from Aesto record system

Health data firm Aesto reported a breach affecting over 9.5 million people after hackers accessed its AWS infrastructure between December 2 and 18.

Alabama-based healthcare data company Aesto notified the Department of Health and Human Services that more than 9.5 million people had sensitive information leaked in a December cyberattack, after previously warning customers in June without disclosing scope. Attackers broke into the company's Amazon Web Services infrastructure between December 2 and December 18, stealing names, Social Security numbers, medical information, driver's license numbers, financial account numbers, and health insurance data. Aesto provides data migration and archiving services for medical facilities, and at least 30 healthcare organizations were affected, with breach notices filed for customers including Together Women's Health. Related healthcare incidents disclosed this year include Baylor Genetics (2.8 million people), CareCloud (3.7 million), and recent attacks at McKesson, Nutex, Paylogix, and Park Dental Partners.

The Record · 13d agoData breach

Pegasus, NoviSpy variant spyware found on devices of Serbian activists

Researchers confirmed the first 2026 Pegasus infection and a new NoviSpy variant on 14 Serbian activists, likely surveillance by Serbian authorities ahead of elections.

Citizen Lab confirmed with high probability the first forensically confirmed Pegasus infection of 2026, on a Serbian student activist hacked via a zero-click exploit between December of last year and January. Amnesty International confirmed two devices infected with a new NoviSpy variant, and the SHARE Foundation documented 14 targets including a member of parliament and a local government official, the largest documented spyware wave in Serbia to date. Evidence points to Serbian police or intelligence services, with NoviSpy infections occurring around police detention ahead of key local and parliamentary elections. Apple threat notifications preceded the findings, and updated iOS versions break the exploit chain.

CyberScoop · 13d agoThreat actor in the wild

Wyden seeks upgraded NSA security guidance on commercial VPN use

Senator Ron Wyden asked the NSA to update public guidance on commercial VPN security risks and answer questions about foreign surveillance threats against single-hop VPNs.

Sen. Ron Wyden sent a letter to NSA Director Gen. Joshua Rudd urging the agency to revise public guidance on commercial VPNs, following earlier letters to federal agencies in March and July. He argues single-hop VPNs offer little protection against sophisticated adversaries able to compel or compromise the single provider, citing a Congressional Research Service paper favoring multi-hop and mixnet architectures. The letter references a September NSA advisory on a China-sponsored campaign against telecom, government and military networks and asks unclassified questions about multi-hop systems such as Apple Private Relay, Tor and Nym versus mixnets.

CyberScoop · 13d agoPolicy & legal