Overview
A September 21 update limited confirmed impact to a subset of Oncology & Multispecialty customers and primarily business contact/order data in Medical-Surgical. Possible fields vary by individual and include identification, contact, insurance, medical and billing data, with some financial or Social Security information. No affected total is given; business-wide patient populations are not breach counts.
Timeline
- Occurred
- Discovered
- Disclosed
Activity discovered.
First official public update.
Substitute notice for individuals.
Update narrowing affected business scope.
Organization response
McKesson contained activity, engaged specialists and notified law enforcement. A September 8 substitute notice offered eligible people 24 months of protection services.
What you can do
Review individualized notices, health-benefit statements, financial accounts and credit reports, and watch for impersonation.
Sources
- Notice of Data Breach, September 8, 2026McKesson · 2026-11-09
- Customer Cybersecurity Information Center: August 28 to September 21 updatesMcKesson · 2026-11-09