ShinyHunters claims it stole 284 million patient records from McKesson
Healthcare company McKesson disclosed a cybersecurity incident in which hackers got into third-party applications and stole data.
McKesson is a major U.S. healthcare company that distributes pharmaceuticals, medical supplies and other healthcare products to pharmacies, hospitals and clinics.
According to the SEC filing, the intrusion was detected on August 25, 2026. The company said the investigation “is in its early stages,” and that it has not determined the incident is material or likely to affect its finances or operations.
McKesson’s cybersecurity information page offers customers the same explanation of the breach as any PR statement aimed at the public.
“Based on our investigation thus far, including assessments by leading cybersecurity industry experts supporting our response, we’ve confirmed that the unauthorized access to certain third-party applications and the exfiltration of certain data was associated with a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units,” said Francisco Fraga, EVP, Chief Information and Technology Officer at McKesson.
The company says its own security team and outside experts are working to limit the impact on system availability and business operations, and that customers may see occasional service degradation the company thinks could be tied to the incident
“Based on the information currently available, we do not believe any action is required by our customers and we are not proactively disconnecting systems within our environment at this time,” Fraga added.
“We continue to monitor our environment closely and take measures to support the security and reliability of our operations,” Fraga concluded.
Although McKesson didn’t share any details on who might be behind the attack and how much data was stolen, it appears that the ShinyHunters extortion group is responsible.
ShinyHunters approached BleepingComputer and said it got in through vishing calls to McKesson employees, then used stolen credentials to take over Okta single sign-on accounts. From there, the group claims it moved into McKesson’s Salesforce and Snowflake environments and pulled out about a terabyte of data over four days.
According to ShinyHunters, it contacted McKesson after finishing the theft on August 25 and demanded $55,236,150, giving the company 72 hours to respond. The group told BleepingComputer that McKesson never answered.
Hackers claims to hold 284 million data records, a figure that reflects database rows rather than individual patients. It lists names, addresses, birth dates, Social Security numbers, patient IDs, Medicaid details, medical record numbers, medication and allergy information, and physician information among what it took, along with internal Salesforce records and employee data.
None of these claims have been independently verified.
It looks like healthcare companies are in hackers’ spotlight lately. Last week we wrote about the Boston Scientific breach, which was just one of many medtech companies hit by cyberattacks this year.
