The group ShinyHunters has claimed credit for the attack, threatening to leak the data trove if McKesson doesn’t pay $55 million. It claims to have highly sensitive records on patients, including autopsy details. 

While LifeStance Health maintains it did not knowingly do anything wrong and is committed to the privacy of its patients, it has agreed to make sure that no third-party tracking technologies are running on its website.

The lawsuit was filed by two major institutional investors who blame company leadership for the 2024 breach on Change Healthcare and accuse executives of facilitating alleged Medicare billing fraud. 

The technology company claims the incident stemmed from a cybersecurity test gone wrong, where its application escaped a closed environment and broke into an external database to complete its task of being an elite hacker

The lawsuit touches on the common complaint of third-party tracking code being used on websites that in some cases captures sensitive information in patient portals and search forms. UCHealth denies the allegations.

The data breach at Singing River Health System occurred in December 2025 and resulted in sensitive medical information being stolen by cybercriminals. If a post on the dark web is to be believed, an infamous group called Anubis is responsible for the intrusion.

The 2025 data breach exposed records on 2.7 million patients. The cybercrime syndicate Interlock claimed credit for the attack, posting its stolen bounty on the dark web shortly after the incident.