Samwise Healthcare IT Newsletter
Friday, September 4, 2026
McKesson Confirms Data Theft as ShinyHunters Claims 284 Million Patient Records Stolen
Healthcare supply-chain giant McKesson has confirmed unauthorized access to data stored in third-party applications, following claims by the ShinyHunters threat group that it stole 284 million patient records and demanded a $55 million ransom. According to an SEC filing, the intrusion was detected August 25 and involved McKesson’s Oncology & Multispecialty and Medical-Surgical business units. Attackers allegedly used voice phishing to compromise employee accounts and access cloud-hosted systems including Salesforce and Snowflake environments. Stolen data reportedly includes names, Social Security numbers, medical diagnoses, medications, and billing information. McKesson has not confirmed the record count and says investigation is ongoing.
Sources: Healthcare IT News
OpenEvidence Launches Darwin AI Models Achieving Perfect Score on Medical Licensing Benchmark
OpenEvidence has launched Darwin, a suite of clinical AI models trained on proprietary medical literature and achieving a perfect score on the MedQA benchmark used to evaluate medical licensing exam performance. The company, whose platform is used by 1.12 million U.S. clinicians, is deepening its push into oncology with decision-support tools tailored to cancer care. The launch comes alongside a $250 million Series D funding round. Darwin is designed to integrate with clinical workflows, offering real-time evidence synthesis at the point of care. OpenEvidence says it plans to expand specialization across additional disease areas following the oncology rollout.
Cityblock Health Acquires Homeward Health to Reach Rural Medicaid Members, Raises $116 Million
Cityblock Health, which provides care coordination for urban Medicaid and dual-eligible members, announced it has acquired Homeward Health and raised $116 million in Series E funding led by General Catalyst. Homeward Health operates a hybrid virtual-and-in-person care model for rural communities, and the combined organization will serve nearly 250,000 members across urban and rural markets. The acquisition represents a strategic pivot toward addressing rural health access gaps within Medicaid managed care. Cityblock said it will leverage Homeward’s rural infrastructure and care model alongside its own technology platform to expand coverage and reduce avoidable hospital utilization in underserved areas.
Sources: Fierce Healthcare
Maryland’s Luminis Health Reports Cyberattack Keeping MyChart Offline Across Three Hospitals
Luminis Health, which operates Anne Arundel Medical Center and two other hospitals across roughly 100 ambulatory sites in Annapolis, Maryland, has confirmed a cybersecurity incident that took MyChart and CareConnectNow offline. The health system said it identified the incident and immediately launched an investigation with legal counsel and third-party cybersecurity experts. As of September 3, patient communication portals remained unavailable. Outpatient appointments will proceed as scheduled unless patients are contacted directly, though the health system warned of possible delays. Luminis has not disclosed whether patient data was compromised and says it will notify individuals if required under applicable law.
Sources: Becker’s Hospital Review
R1 to Acquire Humata Health, Adding AI-Powered Prior Authorization to Revenue Cycle Platform
Revenue cycle management company R1 has announced an agreement to acquire Humata Health, an AI-powered prior authorization automation company, to extend its Phare Operating System platform. Humata Health’s technology uses artificial intelligence to automate touchless prior authorization, reducing administrative burden for healthcare providers and minimizing delays in care delivery. The acquisition accelerates R1’s strategy to comprehensively automate revenue cycle workflows and improve reimbursement accuracy. R1 said the deal strengthens its position in healthcare AI while helping providers reduce administrative complexity. Financial terms were not disclosed. Humata Health will be integrated into R1’s existing platform serving hospitals and health systems nationwide.
Sources: Health IT Answers
WellStack Acquires DeLorean AI to Build Precision Decision Intelligence Platform for Healthcare
WellStack has acquired DeLorean AI, a healthcare-focused artificial intelligence company specializing in predictive analytics, risk stratification, and action-oriented decision support. WellStack described the deal as a significant step toward building what it calls a precision intelligence operating system for healthcare, unifying data, AI, and human expertise to drive better clinical and operational decisions. DeLorean AI’s technology generates recommended actions from predictive models rather than producing analytics outputs alone. Combined, the two companies aim to help health systems and payers move from data-driven insight to actionable intervention. Financial terms of the acquisition were not disclosed in the announcement.
Sources: Health IT Answers
QGenda Scheduling Links Exposed Clinician Schedules and Phone Numbers at Nearly 50 Health Systems
Nearly 50 hospitals and health systems — including Penn Medicine, Johns Hopkins Medicine, Children’s Hospital of Philadelphia, UCSF, and Cedars-Sinai — had publicly accessible web pages through workforce management platform QGenda that revealed clinician schedules and, in some cases, cellphone numbers, The Philadelphia Inquirer reported. The links did not appear in standard Google searches but could be surfaced using basic AI tools. Exposed information included schedules for physicians, nurse practitioners, social workers, and other hospital staff. At least 10 organizations removed public links or added password protection after the Inquirer made contact. QGenda has not publicly commented on the scope of the exposure.
Sources: Becker’s Hospital Review
DaVita Agrees to $15 Million Settlement Over Interlock Ransomware Breach Affecting 2.7 Million Patients
Kidney care provider DaVita has agreed to a preliminary $15 million settlement to resolve class-action claims stemming from a ransomware attack by the Interlock group that exposed data for approximately 2.7 million patients. A Colorado federal judge granted preliminary approval of the settlement. The attack disrupted DaVita’s operations and exposed patient names, Social Security numbers, health information, and other sensitive records. Plaintiffs alleged DaVita failed to implement adequate cybersecurity safeguards. Under the terms, class members may seek reimbursement for out-of-pocket expenses and identity theft protection services. DaVita did not admit wrongdoing as part of the agreement.
Sources: Healthcare Dive
Every newsletter preserved and searchable
Curated by JD · samwise.agency