Pharma Cyberattacks 2026: Is Someone Mapping the Industry?
Three large healthcare companies disclosed cyber incidents within about two months in 2026: Amgen in July, then Boston Scientific and McKesson in late August. Each looked different. Amgen reported data taken from third-party cloud environments, Boston Scientific reported a network outage that disrupted manufacturing and shipping, and McKesson reported data taken from third-party applications. Chad Raduege, a retired U.S. Air Force brigadier general, reads the sequence as a pattern that suggests an adversary mapping the industry. The public record on how each intrusion happened is still incomplete, and at least one incident was claimed by a criminal group, so his reading is an interpretation of the pattern, offered by someone who spent 29 years in military communications and cyber operations.
Raduege spent 29 years in communications, IT and cyber operations, commanded the White House Communications Agency, and served as director of C4/Cyber and CIO for U.S. European Command. He made the case on Open Door Salon, when Lori Ellis asked whether the three incidents told him anything a single one would not.
What happened at Amgen, Boston Scientific and McKesson?
Each company described a different kind of incident. Amgen said unauthorized parties accessed data stored with third-party cloud providers, and in a July 29 filing said it had determined the incident was material. Boston Scientific detected an incident on August 25 that caused a network outage and, in the company’s September 7 filing, “impacted the Company’s ability to manufacture as well as process and ship customer orders.” McKesson discovered an incident the same day involving third-party applications, and an extortion group claimed responsibility. Raduege summarized the spread himself:
What we're seeing are three different companies, three different impacts. Some had released data, some had operational network issues, some had embarrassing things that were revealed as part of that.
Why would three different attacks suggest a pattern?
Because to an offensive cyber operator, variety is what reconnaissance looks like. Raduege described how an attacker thinks about an industry: try several routes, see which defenses hold and which do not, and build a picture of where the weak points are. Three companies breached three different ways fits that shape, in his view.
To me, it creates a trend of there is mapping that is going on.
He voiced the adversary's logic directly:
Hey, we're gonna try a number of different things and see what works. And we're gonna start painting a picture or mapping the landscape of the industry as a whole.
That is a hypothesis about intent, and it deserves the same scrutiny as any other. It is also a useful frame for a security leader: what did an adversary learn about your sector from the companies that were hit?
Does it matter that a criminal group claimed one of them?
Yes, for attribution. McKesson's incident was claimed by an extortion group, which is the ransomware profile Raduege described as thieves who want money. Espionage by a state actor looks different, and it is what concerns him more:
They're interested in getting into your networks and putting a foothold in there where they can study for years and then activate at a time and place of need or of requirement for them.
The two are not mutually exclusive across an industry. Criminal intrusions still expose which companies fall to which techniques, and that information does not stay private. For a deeper look at what a state actor is after, see our explainer on what nation-state hackers actually want from a biotech.
Why are vendors and suppliers now part of the target?
Because the network no longer ends at the company's own walls. Lori Ellis observed that attacks that once concentrated on health systems are reaching vendors, and Raduege tied that to how companies now operate:
Now we have gone to commercial ISPs and we have gone to commercial cloud providers and we have gone to other shared assets that are out there.
Mapping those shared assets can expose weaknesses beyond healthcare, he said, in other critical infrastructure sectors such as water, energy and transportation. Two of the three summer incidents involved third-party environments, which is consistent with that concern.
Does global clinical research widen the exposure?
Yes, according to both of them. Lori Ellis raised global clinical trials as a source of shared vulnerability across countries. Raduege agreed:
Cybersecurity, network connectivity, these are not organizational boundaries, they're not geographical boundaries. It's a worldwide ecosystem.
A multinational trial connects sponsors, contract research organizations, sites and data platforms across jurisdictions. Each connection is part of the map an adversary can draw. Investors hold a version of that map too, and Raduege explains what hackers can do with a VC’s due diligence data.
What should a life sciences company take from the pattern?
Raduege's practical answer is to know which assets matter most and who can reach them, and to treat it as a national security matter. That applies with particular force to smaller companies. An earlier guest on this show argued that small biotechs draw attention because they hold the newest science; Raduege adds that adversaries also look for the easiest way in. Both arguments point at the same companies. Raduege walks through what crown jewel analysis is and explains who is responsible for cybersecurity in a biotech.
He also asked the industry to share what it learns from each incident through its information sharing and analysis centers, so a breach at one company strengthens the next. Companies that want to put their expertise in front of this audience can learn about sponsoring Open Door Salon.
This post is drawn from the recorded, on-the-record conversation between Lori Ellis and Chad Raduege on Open Door Salon. Company details are taken from each company's own disclosure or from published reporting, linked above.