grep -rl "healthcare" ./articles
McKesson's 8-K describes roughly one terabyte exfiltrated between 21 and 25 August 2026, detected on the last day. The chain was vishing to Okta SSO to Salesforce and Snowflake — no CVE, no exploit, no patch. And the claimed 284 million records are database rows, by the attackers' own account.
CNIL penalised Hôpital privé de la Loire over a 2025 breach reaching 524,867 patients and 202,246 family members and carers. External physicians could reach the record system with no VPN and no MFA, and nobody was watching. The data was never sold.
McKesson has confirmed a breach involving third-party applications. ShinyHunters claims a terabyte and 284 million records including Social Security numbers and medical histories, and demanded $55.236 million. The group has also clarified that the figure counts records, not individuals. Nobody knows how many people are affected, including them.
Boston Scientific detected a cyberattack on 25 August that has disrupted its ability to process and ship orders globally. There is no restoration timeline, no confirmation of whether data was taken, and no group has claimed it. This is what a serious incident honestly looks like two days in.
A joint CISA, FBI and HHS advisory puts Medusa past 500 US critical infrastructure organisations as of April 2026, up from 300-plus in March 2025. The number that explains the growth is not the victim count: it is the $100 to $1 million the operation pays initial access brokers.
51 victims since April 2025, mostly outside North America, exploiting a 2024 Schneider Electric flaw and a 2025 Fortinet one. The advisory is worth reading for what it says about which patches actually matter.