ShinyHunters demanded $55.2 million from McKesson to prevent the release of data it claimed to have stolen. McKesson didn't pay. The data was published anyway, via breach-tracking databases, covering an estimated 6.4 million individuals: patients, staff, healthcare provider contacts, and marketing recipients. Names, addresses, dates of birth, phone numbers, employer details, and health information are all confirmed in the dataset. ShinyHunters' claim to also hold Social Security numbers hasn't been independently verified.
Every write-up of this incident will spend most of its words on the payment decision. That's the wrong place to focus.
The decision that gets attention isn't the one that matters most
Whether to pay an extortion demand is a real decision, and a hard one, but it's also one boards are reasonably equipped to make in the moment: weigh the cost, the odds of actually preventing disclosure, the legal and regulatory exposure either way, and choose. McKesson chose not to pay, which is defensible. Payment doesn't reliably prevent publication, and rewarding the model has its own long-run costs.
The decision that actually determines how well an organisation comes through an event like this happens earlier, and it has nothing to do with money. It's whether anyone can say, quickly and with confidence, exactly whose data sits inside the compromised systems.
McKesson's exposure runs past its own customers
McKesson is a distributor. A meaningful share of the data implicated here, provider contacts and marketing recipients, belongs to relationships the company holds on behalf of others, not direct customers of its own. That's the pattern that turns a breach into a notification cascade: every healthcare provider whose contact details sat in that system now has its own obligation to work out, and every marketing list recipient is someone else's customer first.
This is exactly the kind of exposure that third-party notification obligations are built around, and it's exactly the kind that's hardest to map after the fact, under pressure, with a countdown clock the extortion group controls. If the first time anyone tries to answer "whose data is actually in here" is during incident response, the answer arrives too slowly to inform the decisions that need it, including the pay-or-don't-pay call itself.
What "prepared" actually looks like
A ransom decision made without first knowing who else's data sits inside your systems is a decision made with half the picture. The organisations that handle extortion events well aren't the ones with the cleverest negotiating position. They're the ones who already know, before the incident, which systems hold data belonging to third parties, who needs to be told and in what order, and who has the authority to make the payment call without convening a committee first.
None of that is remarkable governance. It's basic data mapping and a pre-agreed decision chain. What's remarkable is how rarely it exists before it's needed.
