ShinyHunters claims it stole 284 million patient records from McKesson
ShinyHunters claims theft of 284 million patient records from McKesson via vishing, Okta takeover, and Salesforce/Snowflake access, demanding $55,236,150.
McKesson disclosed in an SEC filing a cybersecurity incident detected August 25, 2026, involving unauthorized access to third-party applications and data exfiltration affecting a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units. ShinyHunters told BleepingComputer it entered through vishing calls to employees, used stolen credentials to take over Okta single sign-on accounts, and extracted about a terabyte of data from Salesforce and Snowflake environments over four days. The group claims 284 million database rows including names, addresses, Social Security numbers, Medicaid details, medical record numbers, and medication data, and demanded $55,236,150 with a 72-hour deadline; none of these claims have been independently verified.
- Intrusion detected August 25, 2026; SEC filing confirms unauthorized third-party application access and data exfiltration.
- ShinyHunters says vishing calls yielded stolen credentials used to take over Okta single sign-on accounts.
- About one terabyte allegedly exfiltrated from Salesforce and Snowflake over four days.
- Claimed 284 million rows include Social Security numbers, Medicaid details, and medication information.
- Demanded $55,236,150 within 72 hours; claims not independently verified.
Full article456 words · extracted from helpnetsecurity.com · click to collapse
Healthcare company McKesson disclosed a cybersecurity incident in which hackers got into third-party applications and stole data.
McKesson is a major U.S. healthcare company that distributes pharmaceuticals, medical supplies and other healthcare products to pharmacies, hospitals and clinics.
According to the SEC filing, the intrusion was detected on August 25, 2026. The company said the investigation “is in its early stages,” and that it has not determined the incident is material or likely to affect its finances or operations.
McKesson’s cybersecurity information page offers customers the same explanation of the breach as any PR statement aimed at the public.
“Based on our investigation thus far, including assessments by leading cybersecurity industry experts supporting our response, we’ve confirmed that the unauthorized access to certain third-party applications and the exfiltration of certain data was associated with a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units,” said Francisco Fraga, EVP, Chief Information and Technology Officer at McKesson.
The company says its own security team and outside experts are working to limit the impact on system availability and business operations, and that customers may see occasional service degradation the company thinks could be tied to the incident
“Based on the information currently available, we do not believe any action is required by our customers and we are not proactively disconnecting systems within our environment at this time,” Fraga added.
“We continue to monitor our environment closely and take measures to support the security and reliability of our operations,” Fraga concluded.
Although McKesson didn’t share any details on who might be behind the attack and how much data was stolen, it appears that the ShinyHunters extortion group is responsible.
ShinyHunters approached BleepingComputer and said it got in through vishing calls to McKesson employees, then used stolen credentials to take over Okta single sign-on accounts. From there, the group claims it moved into McKesson’s Salesforce and Snowflake environments and pulled out about a terabyte of data over four days.
According to ShinyHunters, it contacted McKesson after finishing the theft on August 25 and demanded $55,236,150, giving the company 72 hours to respond. The group told BleepingComputer that McKesson never answered.
Hackers claims to hold 284 million data records, a figure that reflects database rows rather than individual patients. It lists names, addresses, birth dates, Social Security numbers, patient IDs, Medicaid details, medical record numbers, medication and allergy information, and physician information among what it took, along with internal Salesforce records and employee data.
None of these claims have been independently verified.
It looks like healthcare companies are in hackers’ spotlight lately. Last week we wrote about the Boston Scientific breach, which was just one of many medtech companies hit by cyberattacks this year.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/08/31/healthcare-company-mckesson-data-breach/