Boston Scientific reports an intrusion starting August 25 that remains active and prevents remote-monitoring activation for newly implanted cardiac devices, while also disrupting manufacturing, ordering and shipping. Separately, McKesson confirmed unauthorized access and data exfiltration involving third-party Snowflake and Salesforce systems tied to its Oncology & Multispecialty and Medical-Surgical business units, as ShinyHunters claims theft of more than 284 million records and demands $55.2 million. Both organizations say response and restoration work is underway with external specialists.

How Boston Scientific device monitoring broke

Boston Scientific said unknown intruders compromised its IT environment last week and that the event was still ongoing at the time of its weekend updates. The company said the incident touched only certain on-premise systems, not its cloud-based systems and apps, and that it had observed no sign of further unauthorized IT activity since August 25. It retained CrowdStrike to support investigation and recovery, but gave no timeline for full restoration and said work to restore affected functions and systems access was continuing.

The operational impact extends to cardiac implants placed after August 25. For most new cardiac rhythm management implants, home communicators cannot currently be provisioned, so collected device information cannot move to remote patient management systems until activation becomes possible again.

Insertable cardiac monitors, or ICMs, follow a different provisioning path but are equally affected:

  1. New ICMs are intended to be activated with the Boston Scientific Clinic Assistant app so rhythm episodes are captured correctly.
  2. Pairing between a new ICM and a patient remote monitoring mobile phone currently fails because backend systems are offline.
  3. The implanted hardware continues to record episodes locally.
  4. Clinicians can retrieve stored episodes in person through the Clinic Assistant app by choosing the interrogate function.
  5. Once systems are restored and home equipment can pair successfully, stored data should again flow to remote systems.

Manufacturing, ordering and shipment were also interrupted. The company said it was working toward limited shipment of some products during the week and expected ordering and shipping to return to full capacity after restoration could be shown to be fully operable.

McKesson breach and ShinyHunters extortion claim

McKesson confirmed over the weekend that third-party applications were accessed without authorization and that data was removed in connection with a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units. The confirmation followed statements on Friday by ShinyHunters claiming it had entered the company Snowflake and Salesforce instances and taken data covering millions of patients.

Francisco Fraga, McKesson executive VP, chief information officer and chief technology officer, said in a Saturday statement that the assessment included support from outside cybersecurity specialists. The company said its distribution centers stayed operational and product shipment continued. It also said it had reasonable assurance that the intruders had been removed from the third-party environments and were not persisting in McKesson systems.

The company has not publicly specified how many individuals were affected or precisely what categories of certain data were removed. McKesson supports about 3,300 oncology providers in 29 states, according to its website.

A person speaking for ShinyHunters claimed compromise of more than 284 million records of patient data and demanded McKesson pay $55.2 million to prevent disclosure. That figure remains an attacker assertion, not an independently verified count. Have I Been Pwned operator Troy Hunt has separately cautioned against treating attacker-provided totals as authoritative without confidence in their methods. That caution followed reporting of 12.9 million individuals affected in retailer Carhartt’s alleged breach, about half the total ShinyHunters asserted when data was leaked earlier this month.

According to the ShinyHunters spokesperson, the claimed McKesson dataset includes full names, home and email addresses, phone numbers, dates of birth, Social Security numbers, appointment dates and notes, and sensitive illness details including cancer locations on people’s bodies, plus emails with private doctor-to-patient information. The spokesperson said access to Snowflake and Salesforce was obtained by voice phishing multiple employees, a technique the group has used in other recent healthcare data-theft cases, including pacemaker manufacturer Medtronic in April and cancer diagnostics business Exact Sciences in July.

Detection and mitigation

For Boston Scientific patients with recent implants, the company points to in-clinic retrieval as the interim path until remote links can be activated. Clinicians and patients should coordinate direct follow-up rather than assuming home transmissions are succeeding, and preserve scheduled in-person checks for new implants and ICMs placed after August 25.

For organizations using hosted data platforms, the McKesson case underscores third-party application exposure through identity-based entry:

  • Review Snowflake and Salesforce session, login and data-export activity around suspected phishing dates for unfamiliar users, locations, or bulk downloads.
  • Reset credentials and revoke sessions for targeted personnel, enforce phishing-resistant multifactor authentication, and restrict Snowflake network policies and Salesforce connected-app scopes.
  • Isolate affected third-party service accounts, rotate associated tokens, and validate that no forwarding rules, OAuth grants, or delegated access remain.

Technical background — general patterns only

The following describes common classes of activity in general terms. It is not a finding about these specific incidents.

Voice-phishing-led SaaS theft typically proceeds by persuading staff to approve a login, share a one-time code, or install a remote-access tool, then reusing that session to reach analytics and CRM tenants. Once inside, an actor enumerates databases, stages, shares, reports and attachments, then extracts large result sets through normal query or export features.

A generic illustration of the type of review teams perform, not code from this incident:


-- GENERIC example only: look for unusual data access volume
SELECT user_name, start_time, database_name, rows_produced
FROM SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY
ORDER BY rows_produced DESC
LIMIT 100;


# GENERIC example only: list recent Salesforce login anomalies
# Export EventLogFile Login events via API, then filter for
# unexpected source IPs, ASN changes, or off-hours bulk exports
grep -i "LOGIN" EventLogFile.csv | cut -d, -f1-8 | sort | uniq -c | sort -nr

Device-provisioning outages illustrate a separate dependency: even when an implant records locally, remote care depends on on-premise enrollment, pairing, and message-routing services. If those services are taken offline for containment, new communicators and mobile pairings queue until directories, certificate authorities, and application servers return.

References