{"id":1462,"date":"2026-09-07T12:53:04","date_gmt":"2026-09-07T17:53:04","guid":{"rendered":"https:\/\/cmitsolutions.com\/lasvegas-nv-1206\/?p=1462"},"modified":"2026-09-07T12:53:04","modified_gmt":"2026-09-07T17:53:04","slug":"mckesson-healthcare-data-breach-las-vegas","status":"publish","type":"post","link":"https:\/\/cmitsolutions.com\/lasvegas-nv-1206\/blog\/mckesson-healthcare-data-breach-las-vegas\/","title":{"rendered":"McKesson Data Breach: Las Vegas Practice Risks"},"content":{"rendered":"
\n

Cybersecurity Alert<\/span><\/p>\n

McKesson Data Breach Exposes Patient Records \u2014 What Las Vegas Medical Practices Need to Know<\/h2>\n

A $55 million ransom demand and a phishing attack on cloud accounts show why healthcare vendors are the new front line in cybersecurity.<\/p>\n

Published by CMIT Solutions of Las Vegas \u00b7 Cybersecurity \u00b7 6 min read<\/p>\n<\/div>\n

Late last month, McKesson Corporation<\/strong> \u2014 one of the largest pharmaceutical and medical-supply distributors in the United States \u2014 confirmed that hackers had broken into several of its cloud-hosted accounts and stolen sensitive data belonging to its oncology and medical-surgical business units. The hacking group ShinyHunters<\/strong> claimed responsibility and told reporters it took millions of rows of patient information, including names, addresses, Social Security numbers, diagnoses, medications, and allergy records, along with employee data. The group is reportedly demanding $55 million<\/strong> to keep the stolen files from being published.<\/p>\n

The Attack Didn’t Exploit Software \u2014 It Exploited People<\/h2>\n

This is the part every Las Vegas medical office, dental practice, and healthcare-adjacent small business should sit with: ShinyHunters didn’t breach McKesson through a software vulnerability. According to the group’s own account, they gained access by tricking employees<\/strong> into handing over credentials through phishing and social-engineering tactics \u2014 then used that access to pull data directly out of McKesson’s cloud-hosted Snowflake and Salesforce environments.<\/p>\n

That distinction matters. A firewall or antivirus subscription does nothing to stop an attacker who simply convinces a help desk employee, or an overworked staff member, to reset a password or approve a login prompt. McKesson is the latest in a string of healthcare organizations targeted this year, following breaches at CareCloud, Boston Scientific, Stryker, Abbott, Medtronic, and TriZetto \u2014 several of them tied to the same ShinyHunters and Scattered Spider-linked hacking coalitions that have made “log in as a trusted employee” their signature move.<\/p>\n

Key Takeaway<\/span>
\nThe hackers didn’t need to break in \u2014 they were let in. No amount of spending on network hardware protects a practice whose staff hasn’t been trained to recognize a convincing phishing attempt or a fraudulent access request.<\/em><\/div>\n

How This Kind of Breach Actually Works<\/h2>\n