McKesson says it was hacked, and the attackers claim they made off with millions of patient records.
The company, which distributes medicines and medical devices to hospitals and healthcare practices across the U.S., confirmed the breach and said customers should expect intermittent service degradation while it responds. McKesson has not detailed how the attackers got in, when the intrusion began, or independently verified how many records were exposed. Those numbers are coming from the hackers themselves, who say they exfiltrated data on millions of patients. The company has not confirmed that figure.
McKesson is not a hospital or an insurer. It is the plumbing that gets drugs and devices to the providers who use them, so a prolonged outage risks disrupting supply well beyond McKesson's own systems. That combination, sensitive patient data sitting alongside a critical logistics role, is exactly what makes distributors like this one an increasingly attractive target.
Hacker claims about record counts have a habit of shrinking, or growing, once forensics catch up, so treat the millions figure as a number to watch rather than a number to trust yet.