McKesson 2026 Data Breach
McKesson discovered the cybersecurity incident on August 25, 2026, after employee corporate accounts were targeted.
Exposed Data Types
10 sensitive23- Patient IDs
- Health insurance information
- Health plan member identification numbers
- Medical record numbers
- Dates of medical service
- Healthcare provider information
- Diagnoses
- Medication information
- Medical images
- Treatment information
- Names
- Physical addresses
- Phone numbers
- Email addresses
- Dates of birth
- Test results
- Billing information
- Claims information
- Account numbers
- Credit or debit card numbers
- Financial information
- Social security numbers
- Guarantor information
About This Breach
Its investigation placed the activity between August 20 and 25 and confirmed unauthorized access to third-party applications and the exfiltration of data from them. In an August 28 SEC filing, McKesson said the investigation was at an early stage and it had not determined the incident to be material or reasonably likely to materially affect the company.
McKesson’s August 29 customer update linked the access to a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units. Ordering, distribution centers, product shipments, systems and services remained operational. The company also said it had reasonable assurance that no unauthorized activity remained in its systems.
A September 8 substitute notice explained that McKesson may hold personal and protected health information through the healthcare providers it supplies, so someone may be involved without having a direct McKesson account. Potential fields vary by person and may include identity and contact details, patient identifiers, birth dates, insurance information, medical records and care details, billing and claims information, account, card or banking data, and Social security numbers. Records may concern patients, guarantors or others. No affected-person or unique-record total was disclosed.
McKesson said it activated incident-response procedures, engaged external cybersecurity experts, notified law enforcement, contained the incident and added safeguards. Its data review remains ongoing, after which it plans to coordinate individual notifications with healthcare-provider customers. The substitute notice offers two years of complimentary credit monitoring and identity-theft protection to people who believe they may have been affected.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
