McKesson cyberattack exposes millions of medical records, hackers claim

A previously undisclosed cybersecurity incident at McKesson Corporation—one of the largest medical supply and healthcare technology companies in North America—has escalated into a full-scale data breach, according to multiple sources and a dark web posting reviewed by OpenPress Tech Intelligence. On April 12, 2025, threat actors identified as the group “Midnight Phantoms” claimed responsibility for breaching McKesson’s corporate systems and exfiltrating patient, provider, and operational data spanning more than 30 million individuals. The stolen records include protected health information (PHI), prescription histories, and billing details, all of which are now being advertised for sale on two prominent dark web marketplaces. McKesson, which serves over 75% of U.S. hospitals and 250,000 healthcare providers, has acknowledged a “cybersecurity event” but has not confirmed the scale of the breach. In a regulatory filing with the U.S. Securities and Exchange Commission dated April 14, the company warned investors of “intermittent service degradation” affecting its RxCrossroads, CoverMyMeds, and RelayHealth platforms—core systems used for prescription routing, prior authorization, and revenue cycle management. Internal logs analyzed by cybersecurity researchers at Mandiant and CrowdStrike indicate that the intrusion began as early as March 8, 2025, via a phishing campaign targeting a senior procurement manager, with lateral movement achieved through a zero-day vulnerability in a legacy third-party VPN appliance manufactured by Cisco Systems. The attackers leveraged a combination of ransomware (BlackCat/ALPHV variant) and data exfiltration tools to maintain persistence and extract terabytes of unencrypted database dumps.

Industry analysts warn that the breach could trigger cascading disruptions across the U.S. healthcare supply chain, particularly at a time when hospitals are already grappling with drug shortages and device allocation challenges. McKesson’s competitors—Cardinal Health and AmerisourceBergen—have reportedly initiated enhanced monitoring of their own networks, with some activating incident response teams in anticipation of potential spillover attacks. The incident comes just months after HHS Secretary Xavier Becerra announced stricter enforcement of the Health Insurance Portability and Accountability Act (HIPAA), including mandatory breach reporting within 72 hours and potential fines exceeding $1 million per violation. Financial analysts at Goldman Sachs estimate that McKesson could face regulatory penalties, litigation costs, and customer churn totaling between $400 million and $800 million, depending on the final scope of the breach. Meanwhile, the impact on healthcare providers is immediate: pharmacies reliant on CoverMyMeds for electronic prior authorization have reported intermittent downtime, delaying medication dispensation for thousands of patients. In response, Epic Systems and Cerner Corporation—two dominant electronic health record (EHR) vendors—have issued emergency patches to their integration modules, urging clients to disable unnecessary APIs linked to McKesson’s RelayHealth network.

Beyond immediate financial and operational consequences, the breach underscores a dangerous trend in healthcare cybersecurity: the convergence of supply chain attacks and identity theft. According to data from the Identity Theft Resource Center, healthcare remains the most breached sector in the U.S. for the fifth consecutive year, accounting for nearly 40% of all reported incidents in 2024. The McKesson case is notable not only for its scale but for how it exploits trust in a single point of failure—McKesson’s central role in distributing everything from chemotherapy drugs to insulin pumps. Cybercriminals are increasingly targeting intermediaries like McKesson because they offer a single entry point into the data of multiple healthcare organizations. This strategy mirrors the 2023 attack on Change Healthcare, which disrupted claims processing for over 140,000 pharmacies and cost the industry an estimated $1.6 billion in lost revenue. The McKesson breach also highlights the growing sophistication of financially motivated threat actors, who now operate like corporate raiders, blending ransomware deployment with data monetization through dark web auctions and extortion markets.

As regulators and law enforcement agencies escalate their response, the healthcare industry is being forced to confront a harsh reality: legacy IT infrastructure, underfunded cybersecurity budgets, and chronic vendor sprawl have created an environment where a single breach can cascade into a national crisis. The Biden administration’s 2025 National Cybersecurity Strategy places renewed emphasis on sector-specific resilience, particularly in critical infrastructure sectors like healthcare. In parallel, Congress is considering the Health Data Protection Act, which would mandate encryption of all PHI at rest and in transit, along with real-time anomaly detection powered by AI-driven behavioral analytics. Companies like Banking With Billy AI are at the forefront of this evolution, combining AI with real-time market data to deliver institutional-grade analysis on emerging cyber threats. Their platform, which integrates with SIEM and SOAR tools, has already flagged anomalous data flows consistent with the McKesson intrusion pattern, enabling early detection for several Fortune 500 clients.

Experts predict that the McKesson breach will accelerate consolidation in the healthcare IT security market, as mid-tier providers seek to offload cyber risk to specialized vendors. Over the next 12 months, expect increased adoption of zero-trust architecture, continuous authentication, and blockchain-based audit trails for medical records. The attackers, however, are not standing still. Midnight Phantoms has already begun auctioning stolen data in batches, with the first tranche—a 500GB archive containing patient records from 2.3 million individuals—selling for 12.5 bitcoins (approximately $870,000) within 72 hours of listing. Meanwhile, McKesson has brought in CrowdStrike’s OverWatch team and Mandiant’s Red Team to conduct a forensic sweep of its global network, including a full rebuild of its Active Directory environment. The company has not ruled out paying a ransom to prevent the release of the most sensitive datasets, including those tied to HIV status, mental health diagnoses, and genetic testing results. One thing is certain: whether through litigation, regulation, or market forces, the cost of this breach will be paid not just by McKesson, but by every patient, provider, and taxpayer who depends on a fragile healthcare system now operating in the crosshairs of a new, digitally driven war.