# McKesson / CoverMyMeds Data Breach Class Action - Hall Attorneys, P.C. Canonical overview: https://hallattorneys.com/investigations/mckesson Case docket: https://hallattorneys.com/dockets/mckesson Complaint PDF: https://hallattorneys.com/dockets/mckesson/01-complaint.pdf Filing announcement: https://hallattorneys.com/news/mckesson-class-action LLM-readable complaint summary: https://hallattorneys.com/llms-full-mckesson-complaint.txt Last reviewed: September 1, 2026 ## Case status Hall Attorneys, P.C. and co-counsel filed a putative healthcare data-breach class action against McKesson Corporation and CoverMyMeds LLC on August 31, 2026. The case is Hall v. McKesson Corporation and CoverMyMeds LLC, No. 3:26-cv-02958-D, in the U.S. District Court for the Northern District of Texas, Dallas Division. The complaint contains allegations only. The defendants have not yet had an opportunity to respond, no findings have been made, and no class has been certified. ## Incident status McKesson says it discovered a cybersecurity incident affecting its information systems on August 25, 2026. McKesson's public notice confirms unauthorized access to third-party applications and data exfiltration. McKesson has not publicly identified every affected application, all information involved, or a final number of affected people. BleepingComputer reports that ShinyHunters claimed responsibility, access involving Salesforce and Snowflake after social engineering, approximately one terabyte of exfiltration over four days, and approximately 284 million raw patient-related records or database lines. The reported approximately 284 million figure is not a verified count of unique patients. The group reportedly said it had not completed a unique-person count. McKesson has not confirmed the actor, access method, record count, or asserted data fields. ## Reported, unverified data categories According to threat-actor claims reported by BleepingComputer, the exfiltrated corpus may contain combinations of: - Names, addresses, dates of birth, telephone numbers, and email addresses. - Social Security numbers, patient identifiers, Medicaid numbers, and medical-record numbers. - Medications, allergies, illnesses, disabilities, appointments, physicians, and prescriptions. - Medication shipments, invoices, and provider or clinic information. McKesson has not publicly confirmed those specific categories. Not every category necessarily appeared in every record. ## Could McKesson have my information? Possibly, even if the company name is unfamiliar. McKesson businesses can operate behind prescription approvals, medication-access programs, and pharmacy workflows. None of the clues below proves that a person's data was involved in this incident. 1. A prescription required prior authorization. CoverMyMeds is one of several systems that providers, pharmacies, and plans may use, so a denial or delay alone does not establish a CoverMyMeds relationship. 2. A CoverMyMeds account, email, text, portal message, prior-authorization key, support exchange, or medication-access record exists. 3. Biologics by McKesson filled or managed a prescription. Direct labels, shipment materials, emails, or statements are a stronger connection than the medication type alone. 4. Records exist for copay assistance, patient-assistance, benefit review, insurance verification, reimbursement, prior authorization, or specialty-medication access. The visible program name may be a drug or manufacturer name rather than McKesson. 5. Records exist for oncology, rare-disease, cell or gene therapy, or another complex treatment involving specialty-pharmacy delivery, insurance approval, manufacturer support, or financial assistance. 6. Specialty-pharmacy bottles, shipment labels, packing slips, emails, texts, payment records, or patient-portal records name McKesson, CoverMyMeds, or Biologics. Search email, text messages, patient portals, prescription bottles, shipment paperwork, and saved documents for “McKesson,” “CoverMyMeds,” and “Biologics.” Preserve dated results. McKesson has not published a final affected-person list or public lookup tool. Direct incident notice or a confirmed record match will be more important than a possible service connection. ## Complaint allegations The complaint alleges McKesson and CoverMyMeds failed to reasonably safeguard personally identifiable information and protected health information processed through prescription-technology, medication-access, and pharmacy-management operations. It describes CoverMyMeds services involving electronic prior authorization, benefit verification, financial assistance, prescription management, patient enrollment, and related medication-access workflows. It separately describes EnterpriseRx as a McKesson-hosted pharmacy-management platform. The complaint does not allege that McKesson has confirmed EnterpriseRx as an affected application, and it does not allege that every McKesson business, platform, or dataset was affected. ## Proposed classes and claims The complaint proposes: - A Nationwide Class of natural persons in the United States whose Private Information was accessed, acquired, exfiltrated, or otherwise compromised in the incident McKesson discovered on or about August 25, 2026. - An Iowa Subclass. - A McKesson Pharmacy-Technology Subclass for certain Nationwide Class members whose prescription, benefit, prior-authorization, patient-support, medication-access, or pharmacy-management information was processed through CoverMyMeds, EnterpriseRx, or related McKesson pharmacy technology and compromised in the breach. The complaint pleads negligence, breach of implied contract, and unjust enrichment. Requested relief includes damages and restitution; remediation of proven security deficiencies; stronger identity and access controls; independent security assessment where appropriate; data minimization and protection; improved monitoring and data-loss prevention; and meaningful identity and medical-identity protection services. ## Records to preserve - The complete incident notice and envelope or email, enrollment instructions, deadlines, and later updates. - Records showing a relationship to McKesson, CoverMyMeds, Biologics by McKesson, a connected pharmacy or provider, a patient-support program, an employer, or a business partner. - Relevant prescription, prior-authorization, assistance-program, shipment, and payment records. - Healthcare-themed phishing emails, texts, calls, password-reset messages, or account alerts. - Medical, insurance, benefit, credit, or financial records showing suspicious activity or misuse. - Monitoring records, fraud reports, receipts, and a dated log of time and money spent responding. Do not send passwords, full account numbers, Social Security numbers, medical records, or identification documents through ordinary email or a standard contact form. ## Contact Nicholas Hall Hall Attorneys, P.C. nhall@hallattorneys.com +1 713 428 8967 https://hallattorneys.com/connect Sending information does not create an attorney-client relationship.