What Is This About?

McKesson Corporation (“McKesson”), an Irving, Texas-based pharmaceutical, medical supply, and health IT company that is one of the largest healthcare companies in the U.S., recently reported a data breach to the Securities and Exchange Commission (SEC) that potentially involved the disclosure of private and/or confidential information. Our firm is investigating this incident and can help you understand your rights and potential legal options.

What Happened?

According to a Form 8-K filed by McKesson Corporation with the SEC on August 28, 2026, McKesson discovered a cybersecurity incident affecting its information systems on August 26, 2026. McKesson has been investigating the incident with the assistance of cybersecurity experts and has determined that there was unauthorized access to certain third-party applications and exfiltration of data associated with customers within McKesson’s Oncology & Multispecialty and Medical-Surgical business units. McKesson owns US Oncology, Inc., which provides management services to a network of over 3,000 U.S. oncology providers, split into statewide units, including Texas Oncology, Arizona Oncology, and Rock Mountain Cancer Centers.

According to news reporting, the cybercriminal threat group ShinyHunters has claimed responsibility for the breach. ShinyHunters says that is in possession of 284 million records taken from McKesson’s systems. McKesson has not confirmed whether ShinyHunters was indeed behind the breach. Further details about the breach and the full scope of affected information remain under investigation.

What Information Was Impacted?

McKesson has not yet finished investigating the scope of impacted information, but based on the nature of the affected business segments, which may include U.S. Oncology, the following categories of sensitive personal information and protected health information may have been compromised:

• Name;
• Date of birth;
• Health/medical information relating to treatment, diagnosis, or condition;
• Other medical information;
• Sensitive identifiers such as Social Security number;
• Health insurance information; and
• Other sensitive personal or protected health information.

What Action Can You Take?

Levi & Korsinsky, LLP is investigating whether affected persons are entitled to compensation. If you are a patient of a U.S. Oncology provider or otherwise believe you may have been affected by the McKesson breach, there is no cost or obligation to participate. Follow the link below to find out about your rights and potential legal remedies available.