Samwise Healthcare IT Newsletter
Sunday, September 13, 2026
ShinyHunters Demands $55M Ransom From McKesson After Claiming 284 Million Patient Records Stolen
Drug distribution giant McKesson confirmed a cybersecurity incident discovered August 25 involving unauthorized access to third-party applications and exfiltration of data from its Oncology & Multispecialty and Medical-Surgical business units. ShinyHunters claimed responsibility, saying it vished two McKesson employees then extracted data via compromised Salesforce and Snowflake instances. The group alleges it obtained records on 284 million patients — including names, Social Security numbers, diagnoses, medications, and clinical notes — and demanded $55,236,150 in ransom. ShinyHunters has since threatened to publicly expose the data if the ransom goes unpaid. McKesson filed a Form 8-K with the SEC and engaged cybersecurity experts; core distribution operations remain unaffected while the investigation continues.
Sources: Healthcare IT News, GovInfoSecurity
Health-ISAC Warns Providers That ShinyHunters Is Running Targeted Vishing Attacks on Healthcare Sector
The Health Information Sharing and Analysis Center has alerted healthcare providers that the ShinyHunters cybercrime group is actively targeting the sector with sophisticated voice-phishing campaigns. Group members contact employees on personal mobile phones and email accounts, urging them to bypass corporate security controls and navigate to malicious look-alike login portals. ShinyHunters registers medical-themed impersonation domains — often a target company’s name followed by endings like “.claim” — designed to harvest credentials. The group’s recent exploits, including the McKesson attack and a claim of 15 million records from DentaQuest, mark its shift from traditional ransomware toward identity and SaaS-access extortion targeting healthcare’s cloud infrastructure.
Sources: Healthcare IT News
Boston Scientific Resumes Shipping After Cyberattack Disrupted Global Manufacturing Operations
Medical device maker Boston Scientific has resumed shipping most products from its major distribution centers worldwide, marking a significant recovery from the cyberattack that struck the company August 25. The attack disrupted global operations, preventing the processing and shipment of customer orders and impacting manufacturing — while also hindering remote monitoring capabilities for some of the company’s new cardiac devices. Boston Scientific disclosed the incident to the SEC on August 26 and said its investigation found no impact to the function of implanted cardiac rhythm management devices. The company worked with third-party cybersecurity experts to restore core systems, though it has not provided a timeline for full operational recovery.
Sources: Becker’s Hospital Review
CISA and FBI Warn Hospitals About Gunra Ransomware Group Targeting Unpatched Fortinet Devices
The Cybersecurity and Infrastructure Security Agency and FBI have issued a joint advisory warning hospitals and health systems about Gunra, a ransomware-as-a-service group targeting healthcare organizations through Fortinet authentication-bypass vulnerabilities. Gunra actors exploit two flaws — CVE-2024-55591 and CVE-2025-24472 — in Fortinet’s FortiOS and FortiProxy products to gain initial access. The group employs double-extortion tactics, encrypting data and threatening to publish stolen files on a dark web site within five to seven days if ransoms go unpaid. Gunra, built from leaked Conti source code and active since April 2025, is recruiting affiliates with an 80% cut of proceeds. Healthcare organizations with unpatched Fortinet devices should prioritize updates immediately.
Sources: Becker’s Hospital Review
Trinity Health Michigan Files WARN Notices for 557 IT and Engineering Positions to Be Outsourced
Trinity Health has filed Worker Adjustment and Retraining Notification notices for 557 information technology and engineering employees at its Michigan operations, with the permanent layoffs scheduled between October 25 and November 29. The health system, headquartered in Livonia, is outsourcing the roles — which include IT service desk technicians, clinical application specialists, systems architects, identity and access technicians, and data managers — to a third-party vendor. Trinity cited financial pressures and increasingly complex technology requirements. The move follows the nonprofit’s earlier revenue cycle workforce reduction earlier this year. Trinity said no disruption to patient care is expected from the transition to the outsourced model.
Sources: Healthcare Dive
ARPA-H Commits $62.7 Million to Develop Autonomous FDA-Authorized AI Agents for Heart Failure Patients
The Advanced Research Projects Agency for Health announced a $62.7 million commitment to fund the Agentic AI-Enabled Cardiovascular Care Transformation program, known as ADVOCATE, aimed at creating autonomous AI agents to continuously monitor and treat heart failure patients. The four-year program will award $33.7 million in its first year to recipients including Kaiser Permanente, Duke University, Stanford University, Tempus AI, and Updoc. ADVOCATE targets FDA-authorized AI capable of assessing symptom severity, prescribing drugs, and ordering lab tests without constant clinician oversight. The 39-month pathway includes benchmarking agent performance against cardiologists and large-scale trials within partner health systems before regulatory authorization.
DEA Submits Final Telemedicine Controlled Substance Prescribing Rule to OMB for Review
The Drug Enforcement Administration has submitted its final telemedicine special registration rule to the Office of Management and Budget for review, moving closer to establishing a permanent framework for prescribing controlled substances via telehealth. The proposed rule would create three registration categories: a general telemedicine prescribing registration for Schedule III–V substances, an advanced registration allowing psychiatrists and hospice physicians to prescribe Schedule II–V substances via telehealth, and a platform registration for online telemedicine companies. The DEA has issued four temporary extensions of telehealth prescribing flexibilities since the pandemic — the current one expiring December 30, 2026. A permanent rule would end years of uncertainty for virtual care providers and patients.
Sources: Healthcare IT News
Novo Nordisk Breach Tied to Hardcoded GitHub Credentials Exposed More Than 1TB of Clinical Data
Pharmaceutical giant Novo Nordisk suffered a data breach after extortion group FulcrumSec found hardcoded credentials embedded in client-side code on public-facing websites. A personal access token in a JavaScript bundle granted access to more than 1,000 private Azure DevOps and GitHub repositories, each containing API tokens, database credentials, and service account passwords enabling lateral movement through Novo’s systems. The access reached a collaborative drug discovery database, clinical trial data for approximately 11,500 pseudo-anonymized patients, and proprietary AI models. After Novo Nordisk declined to pay, FulcrumSec leaked more than one terabyte of stolen data. The breach underscores risks from exposed credentials embedded in publicly accessible web code.
Sources: GovInfoSecurity
Every newsletter preserved and searchable
Curated by JD · samwise.agency