McKesson confirms data theft as ShinyHunters demands $55 million
McKesson, one of the largest drug distributors in North America, disclosed that attackers gained unauthorized access to third-party applications and took data associated with a subset of customers in its Oncology and Multispecialty and Medical-Surgical business units. The company said it detected the intrusion on Aug. 25.
The incident matters because of the kind of data the attackers say they hold. The ShinyHunters extortion group claims the haul includes patient names, addresses, birth dates, Social Security numbers, Medicaid details and medication information. McKesson has not confirmed those claims.
What happened
In its filing with the U.S. Securities and Exchange Commission, McKesson said its investigation was in its early stages and that it had not determined the incident was material. Executive vice-president and chief information technology officer Francisco Fraga said customers did not need to take action and that McKesson was not disconnecting systems, though customers could see intermittent service degradation, Help Net Security reported.
ShinyHunters, which McKesson has not named, says it used voice phishing calls to trick employees, then took over Okta single sign-on accounts and moved into Salesforce and Snowflake environments, removing about one terabyte of data over four days. The group says it demanded $55,236,150 (U.S.) and received no reply. It says its figure of 284 million counts database rows, not individual patients.
The data leak
The group later published data it said came from McKesson. Have I Been Pwned, which added the set on Sept. 10, counted 6.4 million unique email addresses belonging to marketing recipients, patients, staff and health-care provider contacts, along with names, dates of birth, phone numbers, addresses and personal health data. Have I Been Pwned classed the breach as sensitive, so it cannot be searched publicly.
The incident came the same week Boston Scientific disclosed a cyberattack, adding to a run of attacks on large health-care suppliers in 2026.
What to do
Patients and providers who deal with McKesson's U.S. specialty and medical-surgical businesses should watch for a notification letter and be wary of calls or emails referring to prescriptions or medical suppliers. Organizations using Okta, Salesforce or Snowflake should train help desk and staff to verify callers, and should restrict bulk data exports from those platforms.
