Security Leaders Weigh In 

Phil Wylie, Senior Consultant & Evangelist, Suzu Labs:

The McKesson incident is another reminder that an organization’s attack surface extends well beyond the systems it directly controls. Third-party applications with access to sensitive data can provide attackers with a path around otherwise mature security controls.

The potential impact is especially concerning in healthcare. When an organization sits at the center of the pharmaceutical and medical supply chain, a cyberattack is no longer just a data-security issue. Disruption can potentially ripple downstream to providers, pharmacies and ultimately patients.

Organizations need to treat third-party access with the same scrutiny as internal access. That means limiting privileges, segmenting critical systems, continuously monitoring vendor connections and having an incident response plan that assumes a trusted third party could eventually be compromised.

The reported 284 million records is a claim from the attackers and should be treated as unverified until McKesson confirms the scope. Regardless of the final number, this incident demonstrates why third-party risk has become one of the most important challenges in defending complex healthcare environments.

John Strand, Owner, Black Hills Information Security, Inc.:

This particular story highlights a major problem that I don’t think enough people spend time thinking about. Complexity is the enemy of computer security.

The more third-party vendors you integrate with, especially SaaS providers, the larger your attack surface becomes. Every integration, API, application, and vendor relationship creates another potential path into your organization.

I also don’t think enough is being done around supply chain security. Organizations should be asking harder questions of their SaaS providers, getting letters of attestation, understanding how these services are secured, and identifying exactly what access those vendors have to their environments.

AI is going to make this problem even bigger.

We’re seeing an explosion of custom-written SaaS applications because AI has dramatically lowered the barrier to building software. That’s fantastic in a lot of ways, but it also means we’re creating more applications, more integrations, more APIs, and ultimately more complexity at an incredible rate.

We’re going to continue seeing vulnerabilities and compromises that originate with third parties. Attackers don’t necessarily need to attack you directly when they can attack something you trust.

Once again, complexity is one of the easiest ways in.

Damon Small, Board of Directors, Xcape, Inc.:

When a third-party application breach hits a healthcare supply chain giant like McKesson, a single vendor integration can escalate into a national patient data crisis. The claim that 284 million records were exfiltrated is alarming, even if core delivery operations remain online. McKesson responded quickly by notifying the Securities and Exchange Commission and engaging external incident response specialists to contain the breach. However, given the company’s central role in drug and supply distribution across North America, organizations supporting critical infrastructure must apply far more rigorous scrutiny to the third-party software partners plugged into their environments. Security teams must enforce least-privilege access, continuously monitor data egress at vendor integration points, and audit partner security controls before a secondary application becomes a primary breach vector.

Critical Takeaways:

• Exfiltration claims of 284 million patient records demonstrate how third-party application vulnerabilities turn peripheral software into massive data exposure events.
• Rapid incident response, including SEC notification and external forensic engagement, is vital to containing blast radius when third-party access is compromised.
• Supporting critical healthcare infrastructure requires rigorous ongoing security auditing and strict access bounds for all vendor software integrations.

When you deliver one-third of a continent’s medicine, your third-party vendors are no longer optional software; they are critical infrastructure.