McKesson's Form 8-K (dated 28 August 2026) says that on 25 August 2026 it discovered a cybersecurity incident affecting its information systems, that its investigation is in its early stages, and that information and updates are available at www.mckesson.com/cybersecurity.

As of the filing date, McKesson had not determined that the incident is material or that it has had, or is reasonably likely to have, a material impact on the company, including its financial condition or results of operations. (source: McKesson Form 8-K)

Correction (24 Oct 2026): removed a reference to an extortion group's unconfirmed claims about patient records and access methods; McKesson's notice and 8-K do not confirm them. (source: McKesson Form 8-K)

Correction (29 Oct 2026): a bare link credit was replaced with a named credit. (source: McKesson Form 8-K)

Correction (29 Oct 2026): McKesson's cybersecurity web page could not be read (the address redirects to an empty page), so the details that only that page gave have been removed: the 28 August customer notice, the involvement of third-party applications and data exfiltration, and the 29 August operations update. The card now rests on McKesson's Form 8-K, and the title has been changed to match. (source: McKesson Form 8-K)