The McKesson files are out, and they come to 6.4 million people

When we covered the McKesson breach at the end of August, the honest answer to how many people were caught in it was that nobody knew. Records are not people, and 284 million records could have meant almost anything. There is a real number now, because the data has been published.

Have I Been Pwned added the breach on 10 September: 6,404,340 unique email addresses, sitting alongside names, dates of birth, genders, phone numbers, physical addresses, employers and personal health data. The 284 million the extortion group ShinyHunters advertised turned out to be rows of raw data rather than individuals. McKesson did not pay the roughly $55 million demanded, so the files went out. The entry is flagged as a sensitive breach, which means you cannot search it publicly; you can only be notified if you have verified that email address with the service.

The contents are worse than a typical marketing list. Reporting on the dump describes appointment dates, medical notes and, in some records, the location of a person's cancer. The affected people are a mixture of patients, staff, healthcare provider contacts and people who were only ever on a marketing list. McKesson's own notice attributes the theft to unauthorised access to "certain third-party applications" and says it hit a subset of customers in its Oncology and Multispecialty and Medical-Surgical units. The company supports around 3,300 oncology providers across 29 states.

There is no password to change here, which is precisely what makes it awkward. What changes is the quality of the scams that follow. Someone who can quote your treatment, your appointment date and your consultant's name does not sound like a stranger, and that is the whole trick. The rule holds anyway: end the call, then dial the number printed on your own paperwork. Tendvane cannot pull a published file back off the internet, and nor can anyone else. What it covers is the part still in your hands, with one-click Backup copying your Documents, Pictures and Desktop to a drive you choose, so that if a better-informed email eventually does land something on your PC, your own files are not the only copy.