McKesson Disclosed Cybersecurity Incident in August

The pharmaceutical distribution firm identified unauthorized data exfiltration affecting business contact and order data.

Updated on Sept. 22, 2026 in Cybersecurity

Bold flat-color editorial illustration in deep red and cream, depicting abstract geometric server and network components, representing a corporate cybersecurity event. — McKesson is notifying affected parties after identifying an unauthorized cybersecurity incident in August 2026 that resulted in the exfiltration of business data. AI Illustration. Upload story photo >

Live Poll

Do you trust large healthcare companies to adequately protect your personal and business data?

In August 2026, McKesson disclosed a cybersecurity incident involving unauthorized access and data exfiltration within its internal systems. The breach impacted specific business units, though core distribution services remained operational.

Why it matters

The incident highlights the ongoing vulnerability of supply chain and enterprise support systems to unauthorized access, potentially disrupting business contact channels. McKesson is currently working to notify affected parties across its Oncology, Multispecialty, and Medical-Surgical business units.

The incident impacted business contact and order data within the Medical-Surgical unit and third-party applications in the Oncology and Multispecialty units. Investigators have verified that data within the North American Pharmaceutical Distribution division remains unaffected.

The players

McKesson

An Irving, Texas-based pharmaceutical distributor and health information technology company providing supply chain management and retail pharmacy solutions.

The details

McKesson identified unauthorized access to its networks and subsequent data exfiltration in August 2026. The firm engaged external cybersecurity experts to perform a forensic investigation into the event. While the company is currently providing substitute notice to potentially affected individuals, the scope of the breach remains limited to specific business units, leaving other critical systems intact.

August 2026: McKesson first disclosed the cybersecurity incident.
September 21, 2026: The company provided a formal update on the investigation.

The Tech Race

This breach follows a pattern established by the 2024 UnitedHealth Group Change Healthcare cyberattack regarding the vulnerability of enterprise business support systems in healthcare. It highlights the sector-wide race to harden third-party application interfaces against persistent unauthorized access attempts.

Customers and business partners of the Medical-Surgical and Oncology units should monitor for notification communications from the firm regarding their data. The company confirmed that operations continue to serve customers across all business lines during the remediation process.

The takeaway

The company is in the process of notifying affected individuals following the confirmed exfiltration of contact and order data. Stakeholders should monitor company updates for future findings on the root cause and the specific number of affected records.