The cost of 284 million patient records

# The cost of 284 million patient records ShinyHunters is claiming they have data on 284 million patients from McKesson. If that number holds, it's not just one of the larger breaches of the year; it's a systemic failure of scale. When you manage data for nearly 300 million people, the margin for error disappears. You cannot "accept some risk" when the risk is an entire population's medical history. The pattern with ShinyHunters is rarely about sophisticated zero-days or state-sponsored stealth. They generally prefer the path of least resistance: leaked credentials, misconfigured cloud buckets, or third-party vendors who didn't bother with MFA. They look for the widest door and walk through it. In this case, they didn't need a skeleton key; they likely found someone who left the porch light on and the front door unlocked. McKesson’s public posture follows the standard corporate playbook. The statements start with a commitment to "patient privacy" and "data security," which is essentially the cybersecurity version of saying "we believe in gravity" right after you've fallen off a cliff. Then comes the shift. They move from explaining what happened to excuse-making, usually by framing the incident as an "unauthorized access event." Calling it an "event" is a convenient linguistic trick. It strips the agency from the attacker and the negligence from the defender. An "event" sounds like a thunderstorm; a breach of 284 million records is a flood caused by someone who forgot to maintain the dam for a decade. The real question isn't how ShinyHunters got in, but why the data was structured in a way that allowed such a massive exfiltration without triggering a single alarm. To move that much volume out of a network requires time or an incredible lack of egress filtering. If this happened over weeks, your monitoring tools failed. If it happened in hours, your architecture is a liability. Who shaped these incentives? Usually, it's the tension between the security team and the operations executives. Security wants segmentation and strict access controls. Operations wants "frictionless" data flow so that pharmacists and clinicians can get their jobs done without jumping through three hoops of authentication. In a company as large as McKesson, friction is viewed as a cost. Security is viewed as a budget line item. When you choose frictionless flow over segmentation, you aren't just helping your employees; you're providing a high-speed rail for attackers to move from the perimeter to the crown jewels. The second-order effect here is where it gets truly ugly. McKesson isn't an island; they are a hub. They sit in the middle of a web involving thousands of pharmacies, clinics, and insurance providers. Those downstream partners now have their patients' data floating on a forum, but they weren't the ones who lost it. We're about to see a massive wave of highly targeted phishing attacks. When an attacker knows your medication history and your provider, the "urgent update regarding your prescription" email becomes almost impossible for a patient to distinguish from a real one. The pharmacies will be the ones dealing with the angry patients, while McKesson deals with the lawyers. Some will argue that no system is perfectly secure and that a breach of this magnitude is inevitable given the size of the attack surface. This is the "too big to protect" defense. It's a lie. Scale actually makes security easier if you do it right, because you can afford the best automation and the most rigorous segmentation. The problem isn't the scale; it's the legacy debt. Most companies this size are running a patchwork of acquisitions from 20 years ago, held together by APIs and hope. They don't have one network; they have twenty different networks pretending to be one. The cost will be measured in more than just regulatory fines or credit monitoring services for the victims. The real cost is the erosion of trust in the healthcare supply chain. Healthcare is currently ranked as the third most targeted sector this week, right behind government and technology. This isn't a coincidence. Healthcare data is permanent. You can change a credit card number or a password, but you cannot change your blood type or your chronic condition history. That makes it the highest-value target on the market. We have to ask the uncomfortable question: At what point does "industry standard" security become professionally negligent? If every major healthcare provider is losing millions of records every few months, then the "standard" is broken. We are treating data breaches as an inevitable cost of doing business, like electricity or rent. But when the "cost" is the private medical history of 284 million people, the business model is fundamentally flawed. If McKesson wants to move past the excuse phase, they should stop talking about their commitment to privacy and start talking about why a single point of failure could expose nearly a third of the US population's health data. Until we see an admission that the architecture was outdated—not just "targeted"—nothing has changed. For now, we wait for the ransom demand or the leak site upload. ShinyHunters doesn't usually keep secrets for long. They like the noise. The most telling part of the response will be the gap between the number of records they admit were taken and the number ShinyHunters actually posts. That gap is where the truth about their internal visibility lives. If the attackers know more about the breach than the victim does, the company isn't managing a recovery; they're just watching a movie of their own failure in real time.