A distributor at the center of US healthcare
McKesson is one of the largest pharmaceutical and medical supply distributors in the United States, moving drugs and equipment through pharmacies, hospitals, clinics and physician networks nationwide. On August 25, 2026, the company discovered that a criminal group had been inside its systems for days, walking away with what may be one of the largest healthcare data hauls of the year.
The extortion group ShinyHunters has claimed credit, saying it pulled roughly 284 million records out of McKesson's cloud systems. McKesson confirmed unauthorized access to third-party applications in a filing with the US Securities and Exchange Commission (SEC), but as of this writing has not confirmed the attackers' figures or the full scope of what was taken.
How the attackers got in
According to security researchers who reviewed the intrusion, ShinyHunters did not exploit a software flaw. It called people. The group ran a voice-phishing (vishing) campaign against McKesson staff, using a lookalike domain, mckesson[.]claims, to pose as internal help desk or IT support. Employees who were fooled handed over credentials or approved access requests tied to the company's Okta single sign-on (SSO) system, the shared login layer that controls access to many of McKesson's other tools.
Once inside Okta, the attackers pivoted into two connected cloud platforms: Salesforce, used for customer and support cases, and Snowflake, a cloud data warehouse where much of the sensitive patient information reportedly sat. Researchers estimate the exfiltration ran from around August 21 to August 25, roughly four days, and moved on the order of 1 terabyte of data out of McKesson's environment. Salesforce support cases were reportedly compromised in full alongside the Snowflake data.
This is not a one-off technique. Security teams tracking ShinyHunters through 2026 have described this exact chain, an SSO account compromised by vishing, then used to reach downstream Salesforce and Snowflake instances, as one of the group's recurring patterns against large organizations this year.
What was actually taken, and what the numbers mean
ShinyHunters says the stolen data includes names, home addresses, dates of birth, Social Security numbers, patient identification numbers, phone numbers, email addresses, Medicaid numbers, medical record numbers, medication and allergy details, diagnosed illnesses and disabilities, appointment records and physician information.
The headline figure, 284 million, needs a caveat the group itself supplied: it is a count of records, or rows, in the stolen data set, not a count of unique patients. A single person can generate dozens of rows across appointments, prescriptions, claims and support tickets, so the number of actual individuals affected is almost certainly far lower than 284 million, though McKesson has not yet published that figure.
The ransom, and McKesson's response
ShinyHunters is demanding $55,236,150 to withhold the data from further release. According to the group, McKesson has not responded to the demand or entered negotiations.
McKesson's public statement, posted to a dedicated page on its corporate website alongside the SEC filing, says the company is in the early stages of investigating the incident and that its investigation into the unauthorized access and data exfiltration is ongoing. The company has not disclosed how many individuals will need to be notified, or under which state and federal breach-notification rules it is currently operating, both of which are typically clarified as an investigation like this progresses.
What this means in practice
For McKesson patients and anyone whose data passed through its systems, the practical risk is identity theft and health-insurance fraud, given the combination of Social Security numbers, Medicaid numbers and medical record numbers in the claimed haul. Anyone who receives a breach notification letter from McKesson or an affiliated pharmacy or clinic should treat it seriously: enroll in any credit monitoring offered, place a fraud alert or credit freeze with the major credit bureaus, and watch explanation-of-benefits statements from insurers for services never received.
For organizations, the lesson is less about patching software and more about identity. Okta and similar SSO providers have become the front door to an organization's entire cloud footprint, and a convincing phone call to the right employee can now do more damage than most software exploits. Help desks and IT support lines are an obvious target precisely because they exist to grant access quickly; verifying a caller's identity through a second, independent channel before resetting credentials or approving an SSO request is one of the few controls that reliably stops this specific attack chain.
