Pharmaceutical giant McKesson warns of 'service degradation' following cyberattack
McKesson, a major pharmaceutical distributor, is experiencing service disruptions following a cyberattack, leading to data exfiltration. The ShinyHunters cybercriminal group claimed responsibility, having previously targeted companies like Salesforce and medical device firms. McKesson is providing credit monitoring and identity protection to affected customers and is continuing its investigation.
McKesson, a leading pharmaceutical and healthcare technology company, is currently grappling with service disruptions following a cybersecurity incident. The company released a public notice and filed documents with the Securities and Exchange Commission (SEC) on Friday evening, stating it is in the early stages of investigating a cybersecurity incident involving an unnamed third-party application. Hackers have gained access to the application and are exfiltrating data, according to McKesson.
“At this time, customers may experience intermittent service degradation that we believe may be related to this incident,” McKesson chief technology officer Francisco Fraga said in a statement. “We are aware of these issues and continue to monitor the situation closely.”
In an update on Saturday, the company revealed that the hackers exfiltrated data associated with customers in their oncology and surgical business units. McKesson is providing credit monitoring and identity protection services to customers whose data was exfiltrated.
The ShinyHunters cybercriminal group took credit for the attack on Friday night, threatening the company with potential leaks in a post on their blog. The group has spent more than two years attacking and extorting some of the largest companies in the world, and earlier this year, the FBI warned that hackers linked to ShinyHunters were demanding substantial ransom payments from companies after stealing data through compromises involving Salesforce environments.
Other victims include Carnival Cruises, Ticketmaster, AT&T, McGraw Hill and ADT and gaming company Rockstar. McKesson reported $106 billion in revenue last quarter. About one-third of all prescriptions in North America are delivered by the company. McKesson is the latest large healthcare company to be attacked this year after medical device giants Boston Scientific and Medtronic both reported cybersecurity incidents. Another large medical device firm, Stryker, was also hit with a cyberattack earlier this year.