Hackers claim millions of patient records stolen during data breach at healthcare giant McKesson

McKesson said it had been hacked and expects intermittent service degradation, while hackers claimed that millions of patient records were stolen, according to TechCrunch. The company distributes medicines and medical devices to hospitals and healthcare practices across the U.S., making the incident relevant to both corporate systems and downstream healthcare operations. The report establishes the breach and the expected disruption, but it does not independently confirm the hackers’ claim about the number of records involved.

McKesson’s latest enrichment shows FY2026 revenue of $403.4B, up 12.4% year over year, for the fiscal year ended March 31, 2026. That scale reflects a business with substantial transaction volume and operational reach, but the company’s 3.6% gross margin and 1.2% net margin leave relatively little room for a prolonged disruption or a material rise in incident-related costs. The breach therefore arrives against a high-revenue, low-net-margin financial profile rather than a software model with wide operating cushions.

The direct company exposure is MCK’s distribution infrastructure: intermittent service degradation could affect order processing, logistics and communications with hospitals and healthcare practices. Patients are the alleged source of the stolen data, while healthcare providers could face knock-on effects if fulfillment or access to systems is interrupted. Regulators and affected parties could also become relevant if the scale of the data loss is substantiated, although the reporting provided here does not identify a specific agency action, lawsuit or financial penalty.

The most important uncertainty is the hackers’ claim itself. McKesson confirmed the hack and anticipated service degradation, but the available reporting does not establish that millions of patient records were stolen, how many systems were accessed, how long the disruption will last or whether medicine and medical-device distribution has been materially interrupted. No remediation cost, ransom demand, customer impact figure or formal regulatory response was provided.

The next evidence should come from McKesson’s updates on service availability, the scope of the affected systems and any confirmation of compromised records. Investors will also need the company’s next financial disclosure to show whether the incident created a measurable cost or affected operations. Until those details arrive, the breach is a clear operational and compliance risk, but the available facts do not quantify its effect on revenue, earnings or the company’s $38.38 diluted EPS.