The drug distributor disclosed a hacking group's intrusion into systems tied to its oncology and multispecialty units, but the company's own materiality determination is still outstanding.
McKesson disclosed in a regulatory filing late last month that hackers gained access to company systems through phishing tied to employee login credentials, reaching Salesforce- and Snowflake-hosted platforms that touch its oncology, multispecialty and med-surg units. A group calling itself ShinyHunters claimed it exfiltrated a large volume of patient-record data and demanded a $55 million ransom by September 1. That deadline has now passed without any confirmed resolution.
The scale of the claimed exfiltration, and the ransom figure itself, come from the threat actor, not from McKesson or an independent investigation, and should be treated as unverified claims.
What is established is McKesson's own regulatory posture: the company has disclosed the intrusion but has not yet filed the amended materiality determination that would tell investors how seriously it regards the breach's financial exposure. Under SEC disclosure rules, a company that determines a cybersecurity incident is material must say so and describe the expected impact. McKesson's silence on that question, past the point where the attacker's own deadline has come and gone, is itself a notable gap in an otherwise routine breach disclosure.
Whether McKesson will file a materiality amendment, and on what timeline, remains unanswered. Until McKesson speaks, or a regulator does, the honest state of the story is what it has been since the ransom deadline lapsed: a breach whose scope is disputed, whose cost is unknown, and whose materiality has not yet been decided.