ShinyHunters Vished McKesson Staff, Claims 284M Records

Boston Scientific and McKesson disclosed separate cyber incidents impacting healthcare operations and sensitive data. Boston Scientific’s ongoing attack disrupted remote monitoring for some implanted cardiac devices, while McKesson confirmed unauthorized access to third-party apps tied to specific business units after ShinyHunters claimed it stole large volumes of patient data by voice-phishing employees.

Key findings

• Boston Scientific said an ongoing cyberattack disrupted remote monitoring/activation workflows for some newly implanted cardiac devices, affecting data transmission to remote patient management systems.
• McKesson confirmed unauthorized access to certain third-party applications and data exfiltration impacting a subset of customers in specific business units.
• ShinyHunters claimed it accessed McKesson’s Snowflake and Salesforce instances and demanded $55.2M, alleging theft of extensive patient PII and health information.
• ShinyHunters attributed the initial access to voice phishing of “multiple employees.”

Who’s being targeted

• Commonly targeted roles: IT Helpdesk, Sales/CRM administrators, Operations teams with access to third-party SaaS apps, Healthcare administrative staff handling patient records, Security awareness training program participants.
• Affected industries: Medical devices / MedTech, Pharmaceutical distribution and medical supplies, Oncology providers and clinical practices, Healthcare IT / patient data services.
• Attack channels: vishing.
• Impersonated: Snowflake or Salesforce support / security team.

Awareness takeaways

• Treat unexpected ‘support’ phone calls as suspicious, verify the caller through official channels before taking any account actions.
• Protect cloud business apps (like CRM/data platforms) as if they hold regulated data, because attackers may target them to steal patient information.
• Don’t accept attacker ‘headline numbers’ or extortion claims at face value, focus on confirmed impact and evidence-driven incident response.

Red flags to watch for

• Unsolicited phone call pressuring for urgent account verification
• Request for MFA codes/approvals or credential-related actions over the phone
• Caller pushes actions that bypass normal internal IT/security processes