McKesson Confirms Breach: ShinyHunters Claims Theft of Patient Data

McKesson, one of the largest U.S. distributors of medicines and medical supplies, has disclosed details of a cybersecurity incident. In a Form 8-K filed with the U.S. Securities and Exchange Commission, the company said that on August 25, 2026 it detected unauthorized access to third-party applications followed by the theft of data. According to McKesson, the investigation is at an early stage, and the incident has not yet been deemed material to the company's financial condition.

In a separate notice to customers, McKesson warned that the attack could cause intermittent service disruptions, but said it was not deliberately taking down systems within its own environment. McKesson has not publicly disclosed exactly which third-party applications were compromised, how the attackers gained access, or what was stolen.

What ShinyHunters Is Claiming

The ransomware group ShinyHunters has claimed responsibility for the attack. Speaking with BleepingComputer, its representatives said access was obtained through voice phishing (vishing) — McKesson employees were tricked into handing over their credentials. According to another of the outlet's sources, the campaign used the domain mckesson[.]claims, which fits a pattern documented by ReliaQuest: the group registers domains in the .claims zone bearing company names in order to impersonate their support desks and IT departments.

By the attackers' account, the vishing led to the compromise of several Okta single sign-on accounts, which were used to gain access to Salesforce and Snowflake environments. Over four days, from August 21 to 25, roughly 1 TB of data was exfiltrated.

The figure of 284 million cited here needs some qualification. ShinyHunters explained that this is not the number of people affected but the number of record rows; how many unique patients they contain, the group itself does not yet know, since the data has not been analyzed. According to its claims, the stolen material includes names, addresses, dates of birth, Social Security numbers, patient identifiers, contact details, Medicaid numbers, information on illnesses, medications and allergies, as well as data on the deceased and the terminally ill, invoices, and internal correspondence.

After stealing the data, the group demanded a ransom of $55,236,150, giving McKesson 72 hours to respond. According to ShinyHunters, McKesson did not react to the demand. BleepingComputer stresses that it was unable to independently verify these claims, and that the company itself has not described the stolen information.

The attack fits into an ongoing wave of data thefts in healthcare attributed to ShinyHunters. Previously named victims have included Medtronic, DentaQuest, iRhythm, OneMedical and AdaptHealth, and Health-ISAC has already warned the industry about the rise of such attacks carried out through social engineering.

Source: Bleeping Computer