Notice of Data Breach

NOTICE OF DATA BREACH

September 8^th, 2026

McKesson is investigating a cybersecurity incident involving third-party applications and unauthorized access and exfiltration of data. McKesson supplies medical equipment, pharmaceuticals, and health information technology to a variety of healthcare providers from which individuals may have received care. Because McKesson works as a vendor to health care providers, personal information, including protected health information, may have been impacted in this incident.

The review of information potentially involved in this incident is still in its early stages. McKesson is posting this substitute notice to share information with individuals who believe their personal information may have been impacted by this incident and provide resources they can use to protect their privacy, including enrolling in two years of complimentary credit monitoring and identity theft protection services.

Our data review is ongoing. Upon completion of our investigation, McKesson will work with our customers as appropriate to determine the most efficient means to notify affected individuals.

WHAT HAPPENED?

On August 25, 2026, McKesson became aware that it had been the subject of a cybersecurity incident targeting employee corporate accounts. Upon discovery, we immediately activated our incident response protocols, launched an investigation with the assistance of leading external cybersecurity experts, and notified law enforcement. Our investigation determined that the incident took place between August 20 and August 25, 2026.

WHAT INFORMATION WAS INVOLVED?

Although our review to determine what information has been affected for impacted individuals is ongoing, information involved for affected individuals may have included information used for identification (such as first and last name, address, phone number, email, patient IDs, and date of birth) and/or one or more of the following:

• Health insurance information (such as primary, secondary or other health plans/policies, insurance companies, member/group ID numbers, and Medicaid-Medicare-government payor ID numbers);
• Health or medical information (such as dates of service, medical record numbers, providers, diagnoses, medicines, test results, images, care and treatment);
• Billing, claims and payment information (such as claim numbers, account numbers, billing codes, credit or debit card numbers, financial and banking information, payments made, and balance due); and/or
• Other personal information used to identify the individual such as Social Security

The information that may have been involved will not be the same for every impacted individual. In addition to patients, some impacted information may describe guarantors who paid bills for health care services and others depending on the results of our investigation.

WHAT WE ARE DOING.

Upon discovery, McKesson immediately took steps to contain the incident. We are conducting a diligent investigation to confirm the nature and scope of the incident. McKesson has also implemented additional safeguards in an effort to prevent similar incidents from occurring in the future. McKesson, along with leading external cybersecurity experts, continues to monitor our systems, the internet, and other sources for activity related to this incident.

WHAT YOU CAN DO.

There are important steps that you can take to reduce the potential risk of fraud and/or identity theft. We are providing you with access to a complimentary 24-month membership of IDX 3B Credit Monitoring. This product provides you with superior identity detection and resolution of identity theft. Its services include a bureau credit report, credit monitoring, web watcher services, and identity fraud loss reimbursement. To activate your membership and start monitoring your personal information, please contact the call center as described below. You can also review the appendix below titled "Steps You Can Take to Protect Against Identity Theft and Fraud" to understand the free resources that are available to you from government agencies and the credit reporting bureaus.

For more information

McKesson regrets any inconvenience or concern caused by this incident. McKesson has established a dedicated call center to offer additional resources and information to people who believe they may have been affected by this incident. Individuals can visit www.mckesson.com/utility/cybersecurity/customer-cybersecurity-information-center/ for more information and details on these resources. A toll-free call center is also available at: 1-855-760-5202, available Monday through Friday, 9 a.m. to 9 p.m. ET. Our corporate headquarters is located at 6555 State Highway 161, Irving, TX 75039.

Steps You Can Take to Protect Against Identity Theft and Fraud

Order Credit Report

We encourage you to remain vigilant against incidents of identity theft and fraud, to review your account statements, and to monitor your credit reports for suspicious activity. Under U.S. law, you are entitled to one free credit report annually from each of the three major credit reporting bureaus. To order your free credit report, visit www.annualcreditreport.com or call, toll-free, 1-877-322-8228. You may also contact the three major credit bureaus directly to request a free copy of your credit report.

Place a Fraud Alert

At no charge, you can also have these credit bureaus place a “fraud alert” on your file that alerts creditors to take additional steps to verify your identity prior to granting credit in your name. Note, however, that because it tells creditors to follow certain procedures to protect you, it may also delay your ability to obtain credit while the agency verifies your identity. As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts on your file. Should you wish to place a fraud alert, or should you have any questions regarding your credit report, please contact any one of the agencies listed below.

It is necessary to contact only ONE of these bureaus and use only ONE of these methods. As soon as one of the three bureaus confirms your fraud alert, the others are notified to place alerts on their records as well. You will receive confirmation letters in the mail and will then be able to order all three credit reports, free of charge, for your review. An initial fraud alert will last for one year.

Place a Security Freeze

You may also place a security freeze on your credit reports. A security freeze prohibits a credit bureau from releasing any information from a consumer’s credit report without the consumer’s written authorization. However, please be advised that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, credit, mortgages, employment, housing, or other services. Under federal law, you cannot be charged to place, lift, or remove a security freeze. You will need to place a security freeze separately with each of the three major credit bureaus listed above if you wish to place a freeze on all your credit files. To find out more about how to place a security freeze, you can use the following contact information:

To request a security freeze, you will need to provide some or all of the following information to the credit reporting agency, depending on whether you do so online, by phone, or by mail:

1. Your full name (including middle initial as well as , Sr., II, III, etc.)
2. Social Security Number
3. Date of Birth
4. If you have moved in the past five (5) years, the addresses where you have lived over the prior five years
5. Proof of current address, such as a current utility bill, telephone bill, rental agreement, or deed
6. A legible photocopy of a government issued identification card (state driver’s license or ID card, military identification, etc.)
7. Social Security Card, pay stub, or W-2
8. If you are a victim of identity theft, include a copy of either the police report, investigative report, or complaint to a law enforcement agency concerning identity theft.

The credit reporting agencies have one (1) to three (3) business days after receiving your request to place a security freeze on your credit report, based upon the method of your request. The credit bureaus must also send written confirmation to you within five (5) business days and provide you with a unique personal identification number (PIN) or password (or both) that can be used by you to authorize the removal or lifting of the security freeze. It is important to maintain this PIN/password in a secure place, as you will need it to lift or remove the security freeze.

To lift the security freeze to allow a specific entity or individual access to your credit report, you must make a request to each of the credit reporting agencies by mail, via their website, or by phone (using the contact information above). You must provide proper identification (including name, address, and social security number) and the PIN number or password provided to you when you placed the security freeze, as well as the identities of those entities or individuals you would like to receive your credit report. You may also temporarily lift a security freeze for a specified period rather than for a specific entity or individual, using the same contact information above. The credit bureaus have between one (1) hour (for requests made online) and three (3) business days (for requests made by mail) after receiving your request to lift the security freeze for those identified entities or for the specified period.

You should also know that you have the right to file a police report if you ever experience identity fraud. Please note that to file a crime report or incident report with law enforcement for identity theft, you will likely need to provide some kind of proof that you have been a victim. A police report is often required to dispute fraudulent items. You can report suspected incidents of identity theft to local law enforcement, your state Attorney General, or the Federal Trade Commission. This notice has not been delayed by law enforcement.

The Federal Trade Commission Identity Theft Clearinghouse can be reached at: 600 Pennsylvania Avenue NW, Washington, DC 20580, www.identitytheft.gov, 1-877-ID-THEFT (1-877-438-4338); TTY: 1-866-653-4261. The Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint with them. You can obtain further information on how to file such a complaint by way of the contact information listed above.

Additional Information for Residents of:

• District of Columbia

You may contact the D.C. Attorney General’s Office to obtain information about steps to take to avoid identity theft: D.C. Attorney General’s Office, Office of Consumer Protection, 400 6th Street, NW, Washington, DC 20001, 1-202-442-9828, www.oag.dc.gov.

• Iowa

You may contact law enforcement or the Iowa Attorney General’s Office to report suspected incidents of identity theft. The Iowa Attorney General’s Office can be reached at: Iowa Attorney General’s Office, Director of Consumer Protection Division, 1305 E. Walnut Street, Des Moines, IA 50319, 1-515-281-5926, www.iowattorneygeneral.gov.

• Maryland

You may also obtain information about preventing and avoiding identity theft from the Maryland Office of the Attorney General: Maryland Office of the Attorney General, Consumer Protection Division, 200 St. Paul Place, Baltimore, MD 21202, 1-888-743-0023, www.marylandattorneygeneral.gov/.

• Massachusetts

You have the right to obtain a police report with respect to this incident. If you are the victim of identity theft, you also have the right to file a police report and obtain a copy of it.

• New Mexico

New Mexico consumers have the right to obtain a security freeze or submit a declaration of removal. You may obtain a security freeze on your credit report to protect your privacy and ensure that credit is not granted in your name without your knowledge. You may submit a declaration of removal to remove information placed in your credit report as a result of being a victim of identity theft. You have a right to place a security freeze on your credit report or submit a declaration of removal pursuant to the Fair Credit Reporting and Identity Security Act. The security freeze will prohibit a consumer reporting agency from releasing any information in your credit report without your express authorization or approval. The security freeze is designed to prevent credit, loans and services from being approved in your name without your consent. When you place a security freeze on your credit report, you will be provided with a personal identification number, password or similar device to use if you choose to remove the freeze on your credit report or to temporarily authorize the release of your credit report to a specific party or parties or for a specific period of time after the freeze is in place. To remove the freeze or to provide authorization for the temporary release of your credit report, you must contact the consumer reporting agency and provide all of the following: (1) the unique personal identification number, password or similar device provided by the consumer reporting agency; (2) proper identification to verify your identity; and (3) information regarding the third party or parties who are to receive the credit report or the period of time for which the credit report may be released to users of the credit report. A consumer reporting agency that receives a request from a consumer to lift temporarily a freeze on a credit report shall comply with the request no later than three business days after receiving the request. As of September 1, 2008, a consumer reporting agency shall comply with the request within fifteen minutes of receiving the request by a secure electronic method or by telephone. A security freeze does not apply in all circumstances, such as where you have an existing account relationship and a copy of your credit report is requested by your existing creditor or its agents for certain types of account review, collection, fraud control or similar activities; for use in setting or adjusting an insurance rate or claim or insurance underwriting; for certain governmental purposes; and for purposes of prescreening as defined in the federal Fair Credit Reporting Act. If you are actively seeking a new credit, loan, utility, telephone or insurance account, you should understand that the procedures involved in lifting a security freeze may slow your own applications for credit. You should plan ahead and lift a freeze, either completely if you are shopping around or specifically for a certain creditor, with enough advance notice before you apply for new credit for the lifting to take effect. You should contact a consumer reporting agency and request it to lift the freeze at least three business days before applying. As of September 1, 2008, if you contact a consumer reporting agency by a secure electronic method or by telephone, the consumer reporting agency should lift the freeze within fifteen minutes. You have a right to bring a civil action against a consumer reporting agency that violates your rights under the Fair Credit Reporting and Identity Security Act.

• New York

You may obtain information about security breach response and identity theft prevention and protection from the following New York state agencies:

New York Attorney General Consumer Frauds & Protection Bureau 120 Broadway, 3rd Floor
New York, NY 10271 (800) 771-7755
www.ag.ny.gov

New York Department of State Division of Consumer Protection 99 Washington Avenue, Suite 650
Albany, NY 12231
(800) 697-1220
www.dos.ny.gov

• North Carolina

You may also obtain information about preventing and avoiding identity theft from the North Carolina Attorney General’s Office: North Carolina Attorney General’s Office, Consumer Protection Division, 9001 Mail Service Center, Raleigh, NC 27699-9001, 1-919-716-6000, www.ncdoj.gov.

• Oregon

State laws advise you to report any suspected identity theft to law enforcement, as well as the Federal Trade Commission. Contact information for the Oregon Department of Justice is as follows: Oregon Department of Justice, 1162 Court Street NE, Salem, OR 97301, 1-877-877-9392, www.doj.state.or.us.

• Rhode Island

You have a right to file or obtain a police report related to this incident. You may obtain information about preventing identity theft from the Rhode Island Attorney General’s Office at: Office of the Attorney General of Rhode Island, 150 South Main Street, Providence, RI 02903; Telephone: 1-401-274-4400; www.riag.ri.gov.

• Vermont

We encourage you to remain vigilant for incidents of potential fraud and identity theft, including regularly reviewing and monitoring your credit reports and account statements.