Have I Been Pwned (HIBP) has confirmed that a cyberattack on medical and pharmaceutical supply company McKesson last month affected roughly 6.4 million individuals, giving the first clear indication of the breach's scale. The data was leaked by the extortion group ShinyHunters, who had initially claimed to have stolen 284 million documents and demanded $55.2 million (£43 million) from McKesson to prevent publication, a sum that apparently went unpaid before the records were released.

The leaked records cover a wide range of people, including patients, staff, marketing recipients and healthcare provider contacts, with exposed information varying by individual but collectively including names, addresses, genders, dates of birth, phone numbers, employer details and sensitive health data such as appointment notes and cancer locations. HIBP did not include Social Security numbers in its analysis despite ShinyHunters' claims that these were also stolen, and McKesson, which supports 3,300 oncology providers across 29 US states, has not publicly confirmed the figures since its last update on 29 August. The breach comes amid a wave of healthcare-sector attacks, with Boston Scientific warning it will miss Q3 financial guidance due to a separate incident, and Veradigm disclosing a breach in which attackers used stolen third-party credentials to access patient data via a company API.