McKesson Confirms Data Exfiltration as ShinyHunters Claims 284 Million Records Stolen
Summary
McKesson says attackers accessed third-party apps and exfiltrated data affecting some customers. ShinyHunters claims vishing and stolen Okta credentials enabled access, but its 284 million-record and extortion claims remain unverified.
Key points
- McKesson detected the intrusion on August 25, 2026, and confirmed unauthorized access to certain third-party applications and data exfiltration associated with a subset of customers.
- The affected business units include Oncology & Multispecialty and Medical-Surgical; McKesson said its investigation is in the early stages.
- ShinyHunters told BleepingComputer it used vishing and stolen credentials to take over Okta single sign-on accounts, then accessed Salesforce and Snowflake environments.
- The group claims it exfiltrated about one terabyte of data over four days and demanded $55,236,150; these claims have not been independently verified.
- ShinyHunters claims to hold 284 million records, a count of database rows rather than individual patients, including personal, medical, and employee information.
- McKesson says it is working with outside experts to limit impact, is not proactively disconnecting systems, and does not currently believe customers need to act.
Article Details
- Victim Organization
- McKesson
- Incident Type
- Unauthorized access to certain third-party applications and data exfiltration; ShinyHunters claims the access began with vishing and stolen Okta credentials.
- Incident Date
- 2026-08-25
- Data Types Exposed
- McKesson confirmed exfiltration of certain data associated with a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units.
- ShinyHunters claimed the stolen data included names, addresses, birth dates, Social Security numbers, patient IDs, Medicaid details, medical record numbers, medication and allergy information, physician information, internal Salesforce records, and employee data.
- Affected Records
- ShinyHunters claimed 284 million database records (rows, not individual patients); not independently verified.
- Affected Data Size
- ShinyHunters claimed approximately one terabyte of data; not independently verified.
- Operational Impact
- McKesson said the investigation was in its early stages and that it had not determined the incident was material or likely to affect finances or operations. It said customers might experience occasional service degradation that could be related to the incident.
- Ransom Or Extortion
- ShinyHunters claimed it demanded $55,236,150 and gave McKesson 72 hours to respond; the group said McKesson did not respond. These claims have not been independently verified.
- Claim Status
- confirmed
MITRE ATT&CK
People
Threat Actors
Products
OktaShinyHunters claims it used vishing and stolen Okta credentials to access McKesson systems.SalesforceFrom there, the group claims it moved into McKesson’s Salesforce and Snowflake environments and pulled out about a terabyte of data over four days.SnowflakeFrom there, the group claims it moved into McKesson’s Salesforce and Snowflake environments and pulled out about a terabyte of data over four days.