The McKesson breach: what is confirmed, and what is only claimed

McKesson found an intrusion on 25 August 2026 and filed an 8-K with the SEC three days later. The filing is short. It says third-party applications were compromised, that there was unauthorised access and exfiltration of data, that the investigation is early, that the company has not determined the incident to be material, and that customers may see patchy service while it is dealt with. That is the confirmed part in full. Everything else circulating — the record count, the data types, the method, the ransom — comes from the extortion group ShinyHunters, which contacted reporters with its own account of what it did. Attackers claiming a large number is not evidence of a large number, and a company confirming an incident is not a company confirming their version of it. This page keeps the two apart, because a month from now the letters that go out will be written against the first column, not the second.

The figure that made the headlines is a count of records, and the group that produced it added a caveat that mostly did not travel with it: it has not finished going through the files and does not know how many unique people are in them. A record is a row. A single course of treatment generates rows in ordering, dispensing and support systems, and the same person turns up again in every one of them. So the number of individuals is smaller than 284 million, by a margin nobody can currently state. It could still be very large — McKesson touches a substantial share of the medicines dispensed in the United States — but large and 284 million are not the same claim. If you see the figure written as patients rather than records, the source has added something.

McKesson is not a consumer brand. It is one of the largest distributors of medicines in the country, and around that it runs services attached to prescriptions and patient support for manufacturers, pharmacies and providers. Individuals end up in those systems through their pharmacy and their clinic rather than by signing up for anything, which is why not recognising the name rules nothing out. It also sets the expectation for how this will reach people if data was in fact taken: not through an account, not through an app, but through a letter that arrives once someone has finished working out whose records were in the files. That step has not started. Our guide to medical data breaches covers why health records need a different response from a leaked password.

One detail from the attackers’ own account deserves more attention than the record count: the operation involved a domain registered to look like a McKesson claims site. Impersonating the company is not a side-effect of this story, it is part of how the intrusion worked, and the same instinct will now be pointed at the public. The conditions are perfect for it — a household-scale name, medical data in the headline, and no way for anyone to check whether they are affected. Expect emails, texts and calls offering to tell you. Treat the route as the test rather than the wording: real notifications arrive by post, do not require a click to find out whether you are affected, and never ask for your Social Security number back. Our breach-letter guide goes through what a genuine one contains.

You do not need confirmation to take the two steps that would be asked of you later. Freeze your credit file at Equifax, Experian and TransUnion — separately, online, free — which stops a new account being opened in your name and is the only measure that blocks rather than reports. Then turn on two-factor authentication on your email, because that inbox is the lever anyone holding your personal details reaches for first. If the claims about medical identifiers hold up, add one habit: read the explanation-of-benefits statements your insurer sends and query any treatment you did not receive. Health records cannot be frozen and cannot be reissued, so noticing misuse early is the whole defence. None of this is wasted effort if the McKesson claims deflate — it is the baseline for the next incident too.

Ademi LLP announced an investigation on 29 August, one day after the disclosure, and more firms will follow — that is the reflex now for any breach with a recognisable name attached. It is worth knowing what the stage means. A firm announcing an investigation is looking for clients. It is not a filed case, not a certified class, and not money waiting to be claimed. If a case is filed and eventually settles, the notice reaches you from a court-appointed administrator, usually by post, and claiming is free. That takes years, not weeks. Until then, anything asking for a fee or for your Social Security number to “register your claim” is a scam that the news cycle handed a script to. Our list of settlements actually taking claims is checked against the official administrator sites.

Whether this turns out to be 284 million records or a fraction of that, the thing that made the data valuable was never held only by McKesson. A current address, a phone number and a list of relatives are what turn a stolen identity record into a call somebody believes, and those are published and sold openly by people-search and data-broker sites regardless of who gets breached next. Removing them is the one step here whose effect outlasts the news, and it needs repeating rather than doing once, because brokers rebuild profiles from public records within weeks. For the general version of the response, our post-breach guide covers it in seven steps.