The McKesson breach: the data is out, and 6.4 million addresses are in it

For two weeks this story ran on an SEC filing and an attacker’s press release. The filing was short: third-party applications compromised, unauthorised access and exfiltration of data, an early investigation, no determination of materiality. Everything with a number in it came from the extortion group. Then the group published, and the argument moved from what people were saying to what anyone can open. The set attributed to the incident carries 6,404,340 unique email addresses and was catalogued by the breach-checking services within hours. That does three things at once: it makes the incident checkable by ordinary people, it puts the first verified figure on the record, and it quietly deflates the figure that had been travelling. Both columns below still matter — the company has confirmed less than the files now show, and the files show far less than the attackers advertised.

The two numbers are not in competition; they count different things, and only one of them can be checked. 284 million was a count of rows claimed before anybody outside the attack had seen the data, with a caveat from the group itself that mostly did not travel: it had not finished going through the files and did not know how many people were in them. 6.4 million is a count of distinct email addresses in what actually got published. A person can hold several addresses, so even that is a ceiling rather than a headcount — but it is a ceiling roughly forty times below the headline. This is the clearest example we have of why a record count should never be read as a number of patients. If you see the August figure still quoted as people, the source has added a word its own source did not use.

McKesson is not a consumer brand. It is one of the largest distributors of medicines in the country, and around that it runs services attached to prescriptions and patient support for manufacturers, pharmacies and providers. Individuals end up in those systems through their pharmacy and their clinic rather than by signing up for anything, which is why not recognising the name rules nothing out. The published set reads exactly like that: patients next to staff, provider contacts and people who only ever received a marketing email. Our guide to medical data breaches covers why health records need a different response from a leaked password.

One detail from the attackers’ own account deserved more attention than the record count: the operation involved a domain registered to look like a McKesson claims site. Impersonating the company was part of how the intrusion worked, and that instinct is now pointed at the public with better material than before. Until 10 September, a message offering to tell you whether you were affected was self-evidently false, because nothing had been released. Now checking is real, which makes a fake check plausible. The test is still the route rather than the wording: real notifications arrive by post, do not require a click to find out whether you are affected, and never ask for your Social Security number back. Our breach-letter guide goes through what a genuine one contains.

Match the response to what is in the set rather than to the headline. There are no passwords in it, so a password rotation is not the job. There are no Social Security numbers among the catalogued fields either, which takes tax-refund fraud off the immediate list. What there is: a name, a date of birth, a current address, a phone number, an employer and health information — the combination used to open credit somewhere else in your name, and to make a cold call sound like it came from your clinic. So: freeze your credit file at all three bureaus, turn on two-factor authentication on your email, and read the explanation-of-benefits statements your insurer sends, querying any treatment you did not receive. Health records cannot be frozen and a date of birth cannot be reissued, which is why noticing misuse early is the whole defence.

Ademi LLP announced an investigation on 29 August, one day after the disclosure, and it was not the last firm to do so — that is the reflex now for any breach with a recognisable name attached, and publication of the data will have accelerated it. It is worth knowing what the stage means. A firm announcing an investigation is looking for clients. It is not a filed case, not a certified class, and not money waiting to be claimed. If a case is filed and eventually settles, the notice reaches you from a court-appointed administrator, usually by post, and claiming is free. That takes years, not weeks. Until then, anything asking for a fee or for your Social Security number to “register your claim” is a scam that the news cycle handed a script to. Our list of settlements actually taking claims is checked against the official administrator sites.

The data that made this set useful was never held only by McKesson. A current address, a phone number and a list of relatives are what turn a stolen identity record into a call somebody believes, and those are published and sold openly by people-search and data-broker sites regardless of who gets breached next. Removing them is the one step here whose effect outlasts the news, and it needs repeating rather than doing once, because brokers rebuild profiles from public records within weeks. For the general version of the response, our post-breach guide covers it in seven steps.