Breaches and incidentsBriefReported by a reputable outlet, citing the company
McKesson (healthcare distribution and health IT): cybersecurity incident disclosed to SEC
McKesson’s 8-K says it discovered “a cybersecurity incident affecting its information systems” on 25 Aug 2026.
- Disclosed
What happened
- McKesson’s 8-K says it discovered “a cybersecurity incident affecting its information systems” on 25 Aug 2026; the investigation was “in its early stages” and materiality not determined. Konbriefing’s summary of later reporting says attackers reached third-party applications and took data tied to a subset of customers in two business units.
- Root cause / initial access: not disclosed in the 8-K.
- Attacker: not named by McKesson. ShinyHunters claimed about 284 million patient records (CM Alliance); unverified and not confirmed by McKesson.
- Response: investigation with updates at mckesson.com/cybersecurity.
Sources
- https://www.sec.gov/Archives/edgar/data/927653/000092765326000247/mck-20260825.htm
- https://www.cm-alliance.com/cybersecurity-blog/major-cyber-attacks-data-breaches-ransomware-attacks-in-august-2026
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.