Hall Attorneys and Co-Counsel File Class Action Following McKesson Healthcare Data Breach

Filed complaint: www.hallattorneys.com/dockets/mckesson

Dallas, Texas – September 1, 2026 – Hall Attorneys, P.C. and co-counsel filed a putative class action on August 31, 2026 against McKesson Corporation and CoverMyMeds LLC in the U.S. District Court for the Northern District of Texas, Dallas Division. The matter is Hall v. McKesson Corporation et al., No. 3:26-cv-02958-D, ECF No. 1.

The complaint arises from the August 2026 cybersecurity incident McKesson says involved unauthorized access to third-party applications and data exfiltration. It alleges the defendants failed to reasonably safeguard personally identifiable information and protected health information.

McKesson identifies two affected business units

In an August 29 customer update, McKesson said its investigation confirmed that unauthorized access to certain third-party applications and the exfiltration of certain data was associated with a subset of customers within its Oncology & Multispecialty and Medical-Surgical business units.

McKesson said it had reasonable assurance there was no ongoing unauthorized activity, but that its investigation remained open and it was still determining the nature and scope of the information involved. The company said it expects to provide complimentary credit monitoring and identity-protection services, together with a dedicated information line, to partners, customers, and their patients whose data was exfiltrated. McKesson has not publicly named every affected customer or application, identified all data elements involved, or announced a final number of affected people.

The alleged scale and sensitivity of the data

The complaint discusses contemporaneous reporting that attributes the incident to ShinyHunters. According to that reporting, the group claimed it removed approximately one terabyte of data over four days and obtained approximately 284 million raw patient-related records or database rows. The group reportedly said those rows do not represent 284 million unique patients and that it had not completed a unique-person count.

The actor reportedly claims the data includes combinations of:

• names, addresses, dates of birth, Social Security numbers, telephone numbers, and email addresses;
• patient identifiers, Medicaid numbers, and medical-record numbers;
• medications, prescriptions, allergies, illnesses, disabilities, appointments, and physician information; and
• medication shipments, invoices, and information about healthcare providers and clinics.

McKesson has not confirmed the threat actor's volume or asserted data fields. If confirmed, however, the reported data would be exceptionally sensitive because it could connect a patient's identity and government or benefit identifiers to detailed information about treatment, medical conditions, and care providers.

Who should check with a healthcare provider?

Patients may want to make an inquiry if they received care from a facility that may be a customer of either identified business unit. McKesson says its Oncology & Multispecialty operations support health systems, independent community practices, specialty pharmacies, and specialty practices, including oncology and other complex-care providers.

McKesson says its Medical-Surgical operations serve physician offices, health systems, laboratories, ambulatory surgery centers, urgent-care and community clinics, oncology clinics, home-health and hospice agencies, home-infusion pharmacies, skilled-nursing facilities, assisted-living facilities, and other long-term-care settings.

Receiving care at one of these facilities does not establish that the facility used McKesson, and a McKesson customer relationship does not establish that the customer was within the affected subset or that any particular patient's data was exfiltrated. A supply relationship by itself also does not show that patient data was present in an affected application.

How to verify whether your provider used the impacted lines

1. Contact the office responsible for privacy. Ask for the HIPAA privacy officer, compliance office, health information management or medical-records department, patient relations office, or facility administrator. Front-desk and clinical staff may not know which vendors or applications the organization uses.
2. Ask a two-part question in writing.First ask whether the facility was a customer of McKesson's Oncology & Multispecialty or Medical-Surgical business unit. Then ask whether McKesson identified the facility, any application it used, or any patient data associated with the facility as part of the August 2026 incident.
3. Ask whether McKesson-linked information included your data. If the provider confirms that it was among the affected customers, ask whether its review shows your information was stored in or transmitted through an affected third-party application, what categories were involved, and when you should expect written notice.
4. Check for vendor clues, but treat them only as clues. Search the provider's website, privacy notices, patient portal, bills, infusion paperwork, home-care or supply records, and shipment labels for “McKesson,” “McKesson Medical-Surgical,” “The US Oncology Network,” “Ontada,” or “iKnowMed.” Those names may justify a follow-up question, but none proves that the provider or patient was affected.
5. Request and preserve the response.Keep the name and title of the person contacted, the date, the exact question, and any written answer. If the provider is still waiting for McKesson's determination, ask which office will issue patient notices and how to update your mailing and email addresses.

The filed case

The complaint proposes a Nationwide Class of people in the United States whose private information was accessed, acquired, exfiltrated, or otherwise compromised in the incident McKesson discovered on or about August 25, 2026. It also proposes an Iowa Subclass and a McKesson Pharmacy-Technology Subclass.

The lawsuit asserts negligence, breach of implied contract, and unjust enrichment. Requested relief includes damages and restitution; remediation of proven security deficiencies; stronger identity and access controls; appropriate independent security assessment; data minimization and protection; improved monitoring and data-loss prevention; and meaningful identity and medical-identity protection services.

Information for patients and caregivers

Patients and caregivers may contact Hall Attorneys if a provider confirms it used one of the two McKesson business units and was within the affected subset, if they receive an incident notice, or if they experience healthcare-themed phishing, medical-identity misuse, prescription fraud, identity theft, expense, or substantial lost time.

In an initial message, provide your state, the name of the healthcare provider, which McKesson business unit the provider identified, whether the provider said it was within the affected subset, whether you received notice, and a short description of any suspicious activity or loss. Do not send passwords, full account numbers, Social Security numbers, medical records, or identification documents through ordinary email or a standard contact form.

—Attorney Nicholas Hall is with Hall Attorneys, a Texas-based law firm focused on complex litigation. He can be found on X at @nicholashall or at www.hallattorneys.com.

Inquiries: nhall@hallattorneys.com