Nothing Was Exploited — They Called the Service Desk
Our CISO’s first reaction to the disclosure. No malware, no vulnerability. Attackers phoned the help desk, posed as employees, and walked out with credentials. The human factor as the entire attack surface.
One Login, Every System
What single sign-on actually does, why users loved it immediately, and the tradeoff nobody priced: compromise one account and the attacker is inside everything that account federates into.
Your Bank Asks More Questions Than Your Help Desk
The comparison that should make every executive uncomfortable. Call your bank and you answer five questions. Call your own service desk and they assume you work there.
Records Are Not Patients
Why the 284 million figure is being reported wrong, why the distinction decides your fine, and how the 500-individual reporting threshold changes what you actually owe.
The Breach You Didn't Have but Have to Notify For
What happens downstream when your Business Associate is the one breached — the wait for confirmation, the notification cost, and whose name ends up on the patient letter.
You Had the Threat Intel — Why Didn't It Land?
Health-ISAC had been warning about this exact playbook. Our CISO on the telephone-game problem inside large organizations, and why “we have things in place” is where warnings go to die.
Pen Test Your Own Help Desk
Not a tabletop. Not a phishing simulation. Actual calls, placed by testers, attempting to get credentials out of your service desk — and why organizations resist the one test that would have caught this.
What Smaller Organizations Should Do Instead
Why being small no longer means being overlooked, the advantages small teams actually have, and the low-cost control our CISO would start with tomorrow.
// INCOMING SITREP
The episode diagnoses the phone call. The SITREP is the fix — the verification protocol, tiered by request type, and the pressure tactics it has to survive.
ACCESS THE BRIEF »One subject, all the way down this week.
On August 28th, McKesson — one of the largest pharmaceutical and healthcare distributors in the country — filed a Form 8-K with the SEC disclosing a cybersecurity incident. They said they discovered it on August 25th, that the investigation was in early stages, and that they had not determined the incident to be material.
Then the extortion group ShinyHunters told BleepingComputer they did it, and explained how.
There was no malware. No exploit. No vulnerability to patch. They made phone calls.
The Human Factor Was the Entire Attack Surface
Our CISO’s reaction to the disclosure was not surprise.
“You can do all the training, but if people don’t follow the training or the procedures — and people get busy — there’s always the human factor.”
The attackers called what they presented as the McKesson service desk, impersonated employees, and obtained credentials. That is the whole entry point. Every dollar spent on endpoint protection, network segmentation, and multi-factor authentication sat unengaged while a person on a support line did exactly what that role is designed to do: help quickly.
And as she pointed out, the reports have started to read identically. Credentials stolen. Actor gets in. Actor dwells. Data exfiltrated. Extortion demand follows. The variation between incidents is shrinking, which tells you the playbook is working.
Her framing of the strategic choice underneath it:
“You either try to prevent it, or you try to detect it faster.”
Single Sign-On Is the Multiplier
This is where a credential becomes a catastrophe.
Single sign-on lets a user authenticate once and pass through to multiple systems without confirming identity again. When it rolled out, users loved it — no more logging in over and over.
“The problem is that one account gets compromised, and now the bad actor is in all of your systems. And they only had to find one account.”
In this case the reported chain ran from compromised SSO accounts into both Salesforce and Snowflake environments, with roughly a terabyte moving over four days.
Actual raised a comparison that landed harder than expected: his son’s Gmail was compromised, and because that Gmail was the sign-in for everything else, the attacker got all of it and drained the accounts. Same architecture, same failure, different scale. What happened to McKesson is the professional version of what happens to a kid with “Sign in with Google” on twenty services.
Your Bank Asks More Questions Than Your Help Desk
The comparison our CISO used should be uncomfortable for most organizations.
Call your bank and ask about your account. You answer a series of questions before they will discuss anything at all. Call your own internal service desk, and in most companies the agent assumes you work there.
“These days you just can’t assume that anymore.”
She has seen organizations run a rotating company passphrase — a word or phrase regenerated daily and distributed internally. You call the help desk, you answer the standard identity questions, and then you also answer what is today’s phrase. An attacker with a complete dossier assembled from LinkedIn and prior breach dumps still cannot produce it, because it was never published anywhere.
Most help desks do not do this. Her diagnosis of why is honest: it is a tradeoff between ease of use and security, and it is ultimately a business decision.
“Sometimes they say, hey, we’d rather have ease of use and we’ll deal with the consequences.”
That decision was made at McKesson, and at most organizations, long before anyone picked up a phone.
This is where the episode hands off. We diagnose the phone call here; the companion SITREP is the fix. Help Desk Social Engineering: How to Build a Verification Protocol That Holds covers which three request types deserve a hardened process, the four verification controls ranked by strength, and — the part most policies miss — the specific pressure tactics your agents will face, including the one HHS flagged where the caller claims to be too busy to take a callback.
Records Are Not Patients
The figure circulating is 284 million, and most coverage is calling that 284 million patients.
It is not. ShinyHunters clarified directly to BleepingComputer that the number is a raw count of records — lines of data — not unique individuals, and that they have not fully analyzed what they took.
That distinction is not pedantic. It determines what the breach costs.
“It is not the amount of data that’s exfiltrated, it’s the number of patient records. Your financial risk is tied to how many unique patients are impacted.”
Our CISO walked the math: your fine is calculated on individuals impacted, not gigabytes stolen. Below the 500-individual threshold, your reporting obligations change entirely. Above it, every unique individual is a notification letter, a year of identity and credit monitoring, and a line item your cyber liability policy may or may not fully absorb.
And determining that number takes time — which is precisely the time the notification clock is already running.
The Breach You Didn’t Have but Have to Notify For
McKesson is not a hospital. It is a distributor and technology provider, which in HIPAA terms makes it a Business Associate to an enormous number of covered entities — pharmacies, provider groups, clinics, health systems.
Which means thousands of healthcare organizations that were never attacked, that have no incident of their own, and that did nothing wrong may have obligations they do not know about yet.
Our CISO walked the chain from the provider’s seat. You sent patient data to the vendor. The vendor confirms your specific data was in the stolen set. Now you notify your patients, and now you carry the cost. But you cannot start until the vendor tells you what was taken and whose it was — so you are waiting on someone else’s forensic timeline to begin your own legally bounded one.
Then the part that stings:
“Even though it wasn’t me and it was somebody I used — patients are getting the notification from you. So now you’re the one that they may not want to do business with again. It’s your reputation now, even though you didn’t do anything wrong.”
The Warning Existed. It Didn’t Reach the Room.
Health-ISAC had been warning about ShinyHunters and this exact approach. So why does a well-resourced organization with access to that intelligence still get hit?
Our CISO’s answer was the telephone game — the one where a message whispered down a line of people arrives unrecognizable at the end.
“Threat intel sits at one end of that telephone line. Executives and the board sit at the other.”
By the time a specific, current, sector-relevant warning traverses a large organization, it has been compressed into a budget request. And the board’s honest read is that controls exist, a threat intel team exists, a SOC is monitoring — so the risk is handled.
Her fix is not more reporting. It is running exercises with the executive team against current, named, emerging risks in your industry, not generic scenarios. When a warning like the Health-ISAC alert lands, that should trigger a board-level exercise the same week.
Pen Test the Help Desk
And if you are the organization the warning is about, the exercise is specific:
“You should have done a pen test on your help desk. If I call, can I get help if I’m not that employee? Can I get their credentials?”
Not a tabletop. Not a policy review. Actual calls from actual testers attempting to obtain credentials.
Organizations resist this, and she named the reasons: it disrupts operations, and people get upset about being tested while they are trying to work. Her response is direct — this is part of the job. The alternative is that the test gets run anyway, by someone who is not on your payroll and does not file a report.
The Extortion Decision
ShinyHunters demanded roughly $55 million with a 72-hour deadline. McKesson did not respond.
Our CISO’s read on why that is usually correct: even if you pay, they already have the data, and there is no mechanism that guarantees deletion.
“It’s like — I’m a bad person, give me this money, and trust me that I’m not going to do anything with your data.”
Law enforcement guidance is consistently not to pay, though a private company retains the decision. Meanwhile the real work is already running inside the organization: attorneys, forensic investigators, and the operating assumption that the data is gone and in the wild. Identity and credit monitoring exist for exactly that scenario.
If You Are Smaller Than McKesson
The natural reaction for a smaller provider group is that this is a big-company problem. Our CISO closed that door firmly.
“Bad actors don’t care anymore. They use bots and AI. They just send them out, and whoever gets hit gets hit.”
You are on the block, and the thief is checking every house. Small is not overlooked.
But small carries real advantages, and she was specific about them. Your inventory is knowable. Your gaps are easier to find. You are training five people on the service desk instead of twenty-five. Your telephone line has fewer people on it, so a warning that arrives at the top actually reaches the bottom.
Her starting point for a small organization: do the fundamentals — training, testing, pen testing — and put in one easy control.
“Have a secret company phrase for the day. Those are small things that you can do that make you more secure, but that are easy. Start with that, and as you mature, build on it.”
Marching Orders
1. Put a Callback Requirement on Your Help Desk
Before any password reset or new MFA device enrollment, call the requester back at the number in your HR system of record — not the number on the ticket. This is the single control that would have interrupted the chain.
2. Call Your Vendors and Get Their Notification Timeline on the Record
Ask every Business Associate in your critical path two questions: were you affected, and what is your discovery date and notification timeline to us. You cannot start your own clock until they start theirs.
3. Find Out What Your Single Sign-On Actually Opens
Map every system one compromised SSO account reaches. Most organizations have never drawn that diagram, and the number is almost always larger than leadership assumes.
Execute the Standard
A phone call to a help desk became a single sign-on account. That account became a data warehouse. And a terabyte was gone in four days.
No malware. No exploit. No vulnerability to patch. Somebody just convinced somebody else that they were internal IT.
And the organizations that will spend the next year notifying patients about it are, in a lot of cases, organizations that were never attacked at all. That is the part healthcare leadership has to sit with. Your perimeter is not your perimeter — it includes every vendor holding your patients’ records.
If you need an outside read on your identity verification procedures, a social engineering assessment against your own service desk, or representation when the auditor asks how a credential was issued, that is the work we do. Verify your security posture or book a strategy call.
Mission success starts with knowing what your vendors owe you, and when.
Execute the standard.
// DECODED TRANSCRIPT
Access the full text logs of this transmission for compliance and review purposes.