ThreatPaper

#healthcare

3 cases

McKesson Data Breach: ShinyHunters, One Phone Call, and 284 Million Rows of Patient Data

ShinyHunters says it vished McKesson employees, took over Okta sessions, and pulled a terabyte from Salesforce and Snowflake between 20 and 25 August 2026. McKesson has confirmed exfiltration of patient data and nothing about how.

Data BreachExtortion & BlackmailSocial Engineering
BlackCat Insider Case: Ransomware Negotiators Who Attacked and Betrayed Their Own Clients

Three men who worked in incident response ran BlackCat attacks. One of them was simultaneously negotiating on behalf of ransomware victims — and passing the attackers his own clients' insurance limits.

RansomwareInsider ThreatExtortion & Blackmail
Change Healthcare / Optum Ransomware Attack (ALPHV/BlackCat): Disruption of US Healthcare Payment Infrastructure

The ALPHV/BlackCat ransomware group compromised Change Healthcare, the largest US healthcare claims clearinghouse, causing a nationwide outage of pharmacy, medical claims, and payment processing affecting hundreds of thousands of providers, pharmacies, and patients — the most significant cyberattack on US healthcare infrastructure to date.

RansomwareFinancial Fraud