ShinyHunters claims it stole 284 million patient records from McKesson
ShinyHunters claims theft of 284 million patient records from McKesson via vishing, Okta takeover, and Salesforce/Snowflake access, demanding $55,236,150.
McKesson disclosed in an SEC filing a cybersecurity incident detected August 25, 2026, involving unauthorized access to third-party applications and data exfiltration affecting a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units. ShinyHunters told BleepingComputer it entered through vishing calls to employees, used stolen credentials to take over Okta single sign-on accounts, and extracted about a terabyte of data from Salesforce and Snowflake environments over four days. The group claims 284 million database rows including names, addresses, Social Security numbers, Medicaid details, medical record numbers, and medication data, and demanded $55,236,150 with a 72-hour deadline; none of these claims have been independently verified.
- Intrusion detected August 25, 2026; SEC filing confirms unauthorized third-party application access and data exfiltration.
- ShinyHunters says vishing calls yielded stolen credentials used to take over Okta single sign-on accounts.
- About one terabyte allegedly exfiltrated from Salesforce and Snowflake over four days.
- Claimed 284 million rows include Social Security numbers, Medicaid details, and medication information.
- Demanded $55,236,150 within 72 hours; claims not independently verified.
- ATT&CK
- T1566.004 Spearphishing VoiceT1078 Valid AccountsT1213 Data from Information RepositoriesT1567.002 Exfiltration to Cloud Storage
- Vendors
- OktaSalesforceSnowflake
- Products
- OktaSalesforceSnowflake
- Threat actors
- ShinyHunters
- Victims
- McKesson
- Organizations
- McKessonBleepingComputer
- Countries
- United States
From the original article
2 min read at helpnetsecurity.com
Healthcare company McKesson disclosed a cybersecurity incident in which hackers got into third-party applications and stole data. McKesson is a major U. S.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.