McKesson Confirms Breach: ShinyHunters Claims 284 Million Patient Records, Demands $55.2 Million

US pharmaceutical distributor McKesson confirmed a network intrusion. ShinyHunters claims it stole employee Okta credentials via vishing, then exfiltrated nearly 1 TB from Salesforce and Snowflake—PII, PHI, and prescription records.

The McKesson breach is the latest healthcare security flashpoint. The US pharmaceutical distributor confirmed a network intrusion. Data-theft group ShinyHunters claims it stole about 284 million patient records and is demanding more than $55.2 million. Attackers used vishing to obtain employee credentials, then entered Salesforce and Snowflake.

Incident Overview

McKesson said the attack ran August 21–25. Attackers used vishing calls to trick employees into leaking Okta credentials, then used those credentials against the company's Salesforce and Snowflake instances. ShinyHunters claims nearly 1 TB exfiltrated: PII, PHI, prescriptions, and billing records covering Oncology & Multispecialty and Medical-Surgical.

McKesson says it reasonably believes the attacker no longer has access and is offering credit monitoring to affected customers. It did not disclose the number of people affected. The same group recently hit Medtronic and Exact Sciences, and after Carhartt refused to pay, dumped about 12.9 million account records.

Technical Details

The chain is human plus cloud config. Vishing bypasses the person; once Okta SSO falls, the attacker inherits the employee's legitimate access to Salesforce, Snowflake, and other SaaS. ShinyHunters' recent campaigns (including the Snowflake customer theft wave) follow the same credential-abuse path. Phishing for SaaS creds is industrialized.

For healthcare, PHI is worth far more than ordinary PII and is bound by HIPAA. Compliance cost of a leak is high, which is why attackers keep targeting providers.

Impact Assessment

If the 284 million figure holds, this ranks among recent healthcare breaches. Names, addresses, SSNs, appointment data, even cancer diagnoses on the black market enable high-precision medical phishing and insurance fraud. Regulatory fines, class actions, and reputational damage will follow. Treat claimed volume with caution; the attack chain itself is vendor-confirmed.

Security Recommendations

• Enforce phishing-resistant MFA (FIDO2 hardware keys) on SaaS admin accounts. SMS or push alone will not stop social-engineered credential attacks
• Audit Salesforce, Snowflake, and other cloud integrations and OAuth grants; revoke anomalous connections
• Run vishing drills for support and admin staff; require a second verification step for sensitive operations
• Monitor cloud access logs for anomalous export behavior; alert on bulk data reads

Sources

• Secret CISO daily brief (2026-09-01)
• CyberSecBrief Daily Briefing (2026-09-01)
• DBAPPSecurity Threat Intelligence Center: McKesson breach analysis