Almeida Law Group is investigating a data breach at McKesson. If you were affected, contact Almeida Law Group.
About McKesson
McKesson Corporation is one of the largest healthcare companies in the United States, founded in 1833 and headquartered in Irving, Texas. It distributes pharmaceuticals and medical-surgical supplies and provides health information technology to hospitals, health systems, pharmacies, and physician offices, delivering approximately one-third of all pharmaceutical products used in North America. Because McKesson operates as a vendor to a wide range of healthcare providers, the personal and protected health information it handles on behalf of those providers can be extensive and highly sensitive.
What Happened?
McKesson was listed in a notice published on the organization’s website on September 8th, 2026. According to that notice, the company discovered on August 25th, 2026, that an unauthorized party had targeted employee corporate accounts. The incident took place between August 20th, 2026, and August 25th, 2026, and involved unauthorized access to third-party applications and the exfiltration of data. McKesson confirmed that affected individuals may have been patients or guarantors associated with its Oncology & Multispecialty and Medical-Surgical business units. The data that may have been involved includes identification information (name, address, phone number, email address, patient IDs, and date of birth); health insurance information (health plans and policies, insurance companies, member and group ID numbers, and Medicaid, Medicare, and government payor ID numbers); health and medical information (dates of service, medical record numbers, providers, diagnoses, medicines, test results, images, and care and treatment details); billing, claims, and payment information (claim numbers, account numbers, billing codes, credit or debit card numbers, financial and banking information, payments made, and balances due); and Social Security numbers. McKesson noted that not every affected individual will have had all of these data types exposed. McKesson is offering 24 months of complimentary IDX credit monitoring and identity theft protection to affected individuals.
The ShinyHunters extortion group claimed responsibility for the attack on or around August 29th, 2026, alleging it stole approximately 1 TB of data and 284 million rows of records, and reportedly demanded $55,236,150 in ransom. McKesson has not publicly confirmed ShinyHunters as the attacker, and security sources note that the 284 million figure reflects database rows rather than unique patients. McKesson reportedly did not respond to or negotiate the demand. Health-ISAC separately warned healthcare organizations about increasing ShinyHunters attacks that use social engineering to compromise corporate accounts and gain access to cloud and SaaS platforms. At least one class action complaint has been filed following this breach, and multiple additional law firms have announced investigations.
Key Facts at a Glance
- Company or Organization: McKesson Corporation
- Industry: Healthcare; Pharmaceutical distribution; Medical-surgical supplies; Health information technology
- Location: Irving, Texas
- Incident type: Unauthorized access and data exfiltration targeting employee corporate accounts and third-party applications
- Date of breach: August 20th, 2026
- Date breach discovered: August 25th, 2026
- Date of consumer notification: September 8th, 2026
- Identity theft protection offered: 24 months of complimentary IDX 3B Credit Monitoring
- Prior breach: McKesson’s SEC filings acknowledge prior cybersecurity incidents; no specific prior breach of comparable scale was identified in public sources
- Litigation status: At least one class action filed (Hall Attorneys, proposing Nationwide Class and Iowa Subclass); multiple additional law firms investigating
- Source: McKesson Notice of Data Breach; HIPAA Journal; BleepingComputer; TechCrunch; ClassAction.org
What Should You Do?
If you received notice from McKesson, enroll in the 24-month IDX credit monitoring offer as soon as possible and note any enrollment deadline communicated in your notice. Beyond that, consider placing a fraud alert or credit freeze with all three major credit bureaus—Equifax, Experian, and TransUnion—to make it harder for someone to open new accounts in your name. Review your credit reports at AnnualCreditReport.com and watch for unfamiliar accounts or inquiries. Because health and medical information was involved, also review your Explanation of Benefits statements from your insurer and check your medical records for services you did not receive, which can be a sign of medical identity theft. If you suspect misuse of your information, report it at IdentityTheft.gov, where you can create a personalized recovery plan.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
