McKesson confirmed 284 million records were stolen
Assessment
The headline "McKesson Confirms Data Breach: 284M Records" runs together two things from different sources. McKesson's 8-K, its notices of 28 and 29 August, and its 8 September Notice of Data Breach confirm unauthorised access and exfiltration and list categories of data that "may have been" involved; none gives any number of records or individuals, and the 8 September notice says the review "is still in its early stages". The 284 million figure is the attacker's row count, which the attacker itself says is not a count of people. McKesson has confirmed no figure of any kind.
Where this claim appeared
Tech-Insider · 2026-08-31
https://tech-insider.org/mckesson-breach-confirmed-sec-filing-ransom-deadline-2026/What “False” means
Contradicted by primary sources. Reserved for claims checked directly against the authoritative record — an advisory that does not exist, a catalogue that does not list the entry, a directive that says something other than what is reported.
1 of 5 · rating scale
Assessed in
McKesson Data Breach: ShinyHunters, One Phone Call, and 284 Million Rows of Patient DataThink this assessment is wrong? Report an error.