The McKesson data breach and the failure of key management

# The McKesson data breach and the failure of key management McKesson has finally confirmed the hit. For a few days, the wire was dominated by claims from ShinyHunters that they had exfiltrated 284 million patient records. Now the company admits it happened. Along with the theft comes a $55 million ransom demand. When a breach of this magnitude hits, the corporate instinct is to release a statement about "taking security seriously" and "working with leading forensics firms." They avoid saying how the attackers got in. They avoid mentioning if the data was encrypted at rest. Most importantly, they avoid admitting that their internal access controls were likely as porous as a screen door in a hurricane. Getting hit is common. The sheer volume of healthcare targets this week—with Aesto Health losing just under 10 million records and CareCloud exposing roughly 3.75 million—shows that the sector is currently a magnet for every opportunistic group on the wire. But handling it with corporate vagueness while a $55 million clock ticks in the background is a choice. It's a choice to prioritize optics over the people whose Social Security numbers are now sitting on a leak site. The narrative around these breaches usually centers on "military-grade encryption." I hate that phrase. It means nothing. It's marketing shorthand used by vendors to convince C-suite executives that they've bought a magical shield. In reality, almost every major entity uses AES-256 for data at rest. The math of AES-256 isn't the problem. The math is fine. The problem is almost always key management. To understand why a "secure" database can still be drained by 284 million records, you need to understand envelope encryption. If you're a sysadmin managing a massive dataset, you cannot simply encrypt every single row with one master key. If that master key is compromised, the entire kingdom falls at once. Instead, we use a hierarchy. In envelope encryption, each piece of data (or group of data) is encrypted with a unique Data Encryption Key (DEK). That DEK is then encrypted—"wrapped"—using a Master Key (MK), which is stored in a dedicated Key Management Service (KMS) or a Hardware Security Module (HSM). To get the data, you send the wrapped DEK to the KMS, the KMS decrypts it using the MK and sends the plaintext DEK back to the application. Claude Shannon, the father of information theory, taught us that the security of a system doesn't lie in the secrecy of the algorithm, but in the entropy and management of the keys. When we see a breach this size, it's rarely because someone "broke" the encryption. It's because the attackers found a way to request those DEKs in bulk or discovered the Master Key sitting in a plaintext configuration file on a forgotten dev server. This isn't a cryptographic flaw. It's a key-management flaw. ShinyHunters typically doesn't spend months calculating discrete logarithms. They find an exposed API key, hijack a session, or exploit a misconfigured cloud bucket. Once they have a privileged token, the "military-grade" encryption is irrelevant because the system sees the attacker as the rightful owner of the keys. The lock is perfect; the thief just found the key under the mat. The corporate response here has been sluggish. When an extortion group sets a deadline and names a specific figure like $55 million, they are signaling that they have already mapped the network. They know exactly what they've taken. For McKesson to simply "confirm an incident" while the data is already being leveraged for ransom suggests a gap between their detection capabilities and their public relations strategy. There is also a second-order effect here that hasn't been priced in yet. McKesson isn't just a company; it's a massive pivot point in the healthcare supply chain. They distribute pharmaceuticals to thousands of pharmacies and clinics. While this specific breach targets patient records, the erosion of trust extends downstream. If an attacker can pivot from patient data to distribution manifests or provider credentials, the risk shifts from "identity theft" to "supply chain disruption." The strongest objection to my critique is that at a scale of 284 million records, the complexity is too high for simple key mismanagement to be the culprit. Some would argue it must have been a sophisticated zero-day exploit in the database engine itself. That's an expensive assumption. History shows us that the simplest path usually wins. Looking back at breaches like the ones we saw in the 2021-2022 era, the most devastating hits didn't come from brilliant code; they came from people forgetting to rotate their API secrets or leaving a backup of the KMS config in a public S3 bucket. Complexity doesn't protect you; it usually just creates more places for a secret to leak. The real question is why we keep seeing this pattern in healthcare. We treat patient data as if it's a static archive, but it's actually a high-velocity asset. Every time a record is accessed, a key is requested. If you have millions of requests happening per second without strict rate-limiting on your KMS or anomaly detection on your DEK requests, you aren't running a secure system. You're running a vending machine for attackers. If McKesson wants to actually fix this—and not just pay a consulting firm to write a report that stays in a drawer—they have to stop focusing on the "grade" of their encryption and start focusing on the lifecycle of their keys. That means implementing strict identity-based access for every single key request, enforcing short-lived credentials, and auditing KMS logs for bulk exfiltration patterns. It also means moving away from long-lived secrets that can be stolen and reused for months. The cost to deploy a proper KMS architecture with automated rotation and granular IAM policies isn't $55 million. For an organization of this size, the licensing and engineering hours would likely run in the low seven figures, depending on their existing cloud footprint. It's a rounding error compared to the ransom demand or the eventual regulatory fines. The tragedy is that they’ll probably spend more on the lawyers than they would have spent on the architecture.