Organization

Flashpoint

0 mentions in 7 days · 3 in 30 days · 3 total · first seen Aug 17, 2026 · last 15d ago

Timeline3 articles

McKesson copes with fallout from data theft extortion attack

McKesson discloses a data theft extortion attack by ShinyHunters affecting oncology and medical-surgical customers, with a reported $55 million demand.

McKesson disclosed that attackers gained access to some of its third-party applications and stole data associated with a subset of customers in its oncology, multispecialty, and medical-surgical business units; the intrusion ran for four days from August 21 and was discovered August 25. ShinyHunters claimed responsibility and listed McKesson on its data-leak site, reportedly demanding more than $55 million with a September 1 deadline. Flashpoint analysts say the group typically uses social engineering and identity weaknesses with valid credentials to access cloud-hosted environments, making the intrusion hard to detect. McKesson, which distributes about one-third of pharmaceuticals used in North America with $403.4 billion in annual revenue, says operations continue and it has reasonable assurance of no ongoing unauthorized activity.

CyberScoopAug 31, 21:39 UTC · 15d agoData breach in the wild

Details emerge on BlackFile's recent attacks on financial companies

BlackFile (UNC6671), a The Com-linked extortion crew, keeps hitting financial and med tech firms with voice-phishing IT-support scams and ~$3 million demands.

Google Threat Intelligence Group (tracking BlackFile as UNC6671, linked to The Com) reports the extortion group remains active, shifting focus to the financial sector and med tech organizations, with new Redact-brand extortion demands issued last week. The group impersonates IT support in voice-phishing attacks using hundreds of recruited callers, targets large firms in what researchers call big-game hunting, and processes an average of 1.5 new victims daily. Extortion demands start around $3 million and are typically negotiated below $1 million; Flashpoint observed infrastructure targeting Blackstone, Bain Capital, Moody's, CME, and Apollo, though compromise is unconfirmed. Mandiant has responded to more than two dozen BlackFile compromises since January, and victims face escalation tactics including swatting.

CyberScoopAug 17, 20:41 UTC · 29d agoThreat actor in the wild

Infostealers Harvest 1.7 Billion Credentials in Six Months

Flashpoint reports infostealers harvested 1.7 billion credentials in the first half of 2026.

Threat intelligence firm Flashpoint found that infostealer malware was responsible for the theft of 1.7 billion credentials during the first half of 2026. The figure underscores the scale of commodity credential harvesting feeding downstream account takeover, fraud and ransomware operations.

Infosecurity MagazineAug 17, 07:30 UTC · 29d agoMalware in the wild

Appears with

vendor Flashpoint 2 threat actor Helix 1 organization Health-ISAC 1 threat actor Redact 1 threat actor ShinyHunters 1 threat actor The Com 1 threat actor UNC6671 1 malware infostealers 1 organization Apollo 1 organization Bain Capital 1 organization Blackstone 1 organization CME 1 organization FBI 1 organization Google Threat Intelligence Group 1 threat actor Pink 1 threat actor Falcon 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.