McKesson Discloses Data Breach Amid ShinyHunters Extortion Claim
McKesson, one of the largest healthcare and pharmaceutical distributors in the United States, disclosed on August 28, 2026 that it had suffered a cybersecurity incident involving unauthorized access to third-party applications and the theft of data. In a filing with the U.S. Securities and Exchange Commission, the company said it discovered the intrusion on August 25 and that its investigation was still in its early stages, adding that it had not yet determined whether the incident would have a material impact on its business.
The extortion group ShinyHunters told reporters it was responsible for the breach, claiming its members used voice-phishing (“vishing”) calls to trick McKesson employees into handing over credentials for the company’s Okta single sign-on service. According to the group, that access was then used to reach McKesson’s Salesforce and Snowflake cloud environments, from which roughly 1TB of data was allegedly exfiltrated over four days in late August. The group said the Snowflake data alone amounted to about 284 million individual records — a figure it later clarified refers to raw data rows rather than a count of distinct patients.
ShinyHunters claims the stolen material includes patient names, addresses, Social Security numbers, medical record and Medicaid numbers, prescription and treatment details, and information tied to healthcare providers and McKesson employees, and that it demanded a ransom of roughly $55 million with a 72-hour deadline that McKesson did not meet. McKesson has not confirmed which data was taken or how the attackers gained entry, and the group’s claims have not been independently verified. The incident is the latest in a string of social-engineering-driven breaches this year attributed to ShinyHunters at healthcare and health-technology firms, including Medtronic, DentaQuest, and iRhythm.