Clearwater reported that McKesson representatives confirmed data exfiltration occurred, though the full scope was still under investigation.
Public source
Publisher name
Public post
ShinyHunters, a threat actor whom Clearwater has reported on regularly during our Monthly Cyber Briefing, claims that it has stolen 284 million patient-related records f…
Company
Clearwater
Moving healthcare organizations to a more secure, compliant, and resilient state so they can achieve their mission™
- Industry
- Computer and Network Security
- Location
- Nashville, US
- Company size
- 201–500 employees
About Clearwater
Clearwater serves a diverse and growing base of customers across the healthcare ecosystem, including several of the nation’s largest health systems as well as a large universe of regional hospitals, physician practice management groups, digital health and other healthcare technology companies, medical device manufacturers, and business service providers. Our mission is to help those organizations move to a more secure, compliant, and resilient state so they can achieve their mission.
See moreLatest activity
Latest activity from Clearwater
10 signals
Research & Knowledge
Clearwater will update its threat data on who attackers are targeting, which threat actors are driving the activity, and whether that concentration on smaller healthcare organizations is continuing on September 10.
Research & Knowledge
Clearwater will have David Bailey, Brian McManamon, and Steve Akers examine how attackers are using valid credentials, excessive permissions, misconfigurations, dormant accounts, and trusted integrations to move through healthcare cloud and SaaS environments on September 10.
Research & Knowledge
Clearwater tracked 74% of healthcare ransomware victims from specialty practices and dental organizations last month.
Discover more
Similar signals
Similar public activity from other companies.
Legal & Regulatory
AppOmni
AppOmni reported that McKesson's Salesforce and Snowflake infrastructure was attacked, resulting in the theft of approximately 1 terabyte of data between August 21 and August 25.
Legal & Regulatory
Secure Blink
Secure Blink reported that McKesson confirmed a breach involving 1TB of patient data exfiltrated from Okta SSO credentials, Salesforce fully accessed, and Snowflake drained of bulk records, filed with the SEC on August 25, 2026, and has not responded to the ransom.
Legal & Regulatory
ControlAltProtect
ControlAltProtect reported that a US healthcare giant breached patient records claiming 284 million records.
Legal & Regulatory
Freeze
Freeze reported that McKesson disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft following a vishing attack against employees at ShinyHunters.
Legal & Regulatory
Echelon Risk + Cyber