McKesson Confirms Data Exfiltration After ShinyHunters Claims 284 Million Records Stolen
Summary
McKesson confirmed unauthorized access to third-party apps and data exfiltration; its investigation is ongoing. ShinyHunters claims vishing enabled access and theft of 284 million records, but the claims are unverified and records do not equal patients.
Key points
- McKesson disclosed unauthorized access to third-party applications and data exfiltration. It said it discovered the incident on August 25, 2026, and its investigation is ongoing.
- McKesson has not publicly identified the affected applications or the information taken. It said it had not determined the incident to be material.
- McKesson warned customers of possible intermittent service degradation believed to be related to the incident; it said it was not proactively disconnecting systems.
- ShinyHunters claimed vishing against employees compromised Okta accounts, which the group says it used to access McKesson’s Salesforce and Snowflake environments. These claims have not been independently verified.
- ShinyHunters claimed it exfiltrated about 1 TB over four days and took roughly 284 million patient-related data records; that figure is a count of records, not unique people. McKesson has not disclosed what data was stolen.
- BleepingComputer reported that mckesson[.]claims was used in the attack; ReliaQuest had documented a ShinyHunters campaign using company-named .claims domains to impersonate help desks and IT teams.
Article Details
- Victim Organization
- McKesson
- Victim Domain
- mckesson.com
- Incident Type
- Unauthorized access to third-party applications, reportedly following vishing attacks, and data exfiltration; ShinyHunters claimed responsibility and described the incident as an extortion attack.
- Incident Date
- 2026-08-21
- Data Types Exposed
- ShinyHunters claimed the data included names, addresses, dates of birth, Social Security numbers, patient IDs, phone numbers, email addresses, Medicaid numbers, medical record numbers, medication and allergy information, illnesses, disabilities, appointment and physician information, prescriptions and medication shipments, invoices, employee information, Salesforce records, internal communications, and information about healthcare providers and clinics. McKesson has not disclosed the stolen information, and these claims have not been independently verified.
- Affected Records
- ShinyHunters claimed approximately 284 million data records or lines, not 284 million unique patients. The claim has not been independently verified, and the group said it had not determined how many unique people were represented.
- Affected Data Size
- ShinyHunters claimed approximately 1 TB of data was exfiltrated over four days, from August 21 to August 25, 2026; not independently verified.
- Operational Impact
- McKesson warned customers of possible intermittent service degradation believed to be related to the attack. It said it was not proactively disconnecting systems and had not determined that the incident was material or had a material business impact.
- Ransom Or Extortion
- ShinyHunters claimed it demanded $55,236,150 and gave McKesson 72 hours to respond. The group said McKesson did not respond or negotiate; these details have not been independently verified.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | mckesson[.]claims | Reportedly used in the attack; the domain fits a ShinyHunters campaign pattern used to impersonate targeted companies’ help desks and IT teams. |
MITRE ATT&CK
Threat Actors
Products
OktaThe attackers reportedly used vishing to compromise Okta accounts and access McKesson’s Salesforce and Snowflake environments.SalesforceThe attackers reportedly used vishing to compromise Okta accounts and access McKesson’s Salesforce and Snowflake environments.SnowflakeThe attackers reportedly used vishing to compromise Okta accounts and access McKesson’s Salesforce and Snowflake environments.
Industries
HealthcareHealthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claimingPharmaceutical distributionHealthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming