NEW YORK, Sept. 3 — The prolific hacker group ShinyHunters has claimed responsibility for a cyberattack against McKesson, one of the nation’s largest healthcare and pharmaceutical distributors, alleging the theft of 284 million patient data records. The claim, posted on ShinyHunters’ data leak site, refers to rows of raw data rather than unique patients, according to The HIPAA Journal. McKesson has confirmed data was exfiltrated but has not yet named the responsible group or determined the full extent of the theft.
The company disclosed the incident in a Form 8-K filing with the U.S. Securities and Exchange Commission, first detecting unauthorized activity on August 25, 2026, and announcing it publicly on August 28. McKesson described the event as “a cybersecurity incident involving third-party applications and unauthorized access and exfiltration of data.”
What was taken
ShinyHunters claims the stolen data includes names, contact information, Social Security numbers, dates of birth, medical record numbers, Medicaid numbers, medication and allergy information, diagnoses, and appointment details. The data appears to relate to McKesson’s Salesforce environment and Snowflake, and to a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units. McKesson said it activated incident response protocols and engaged leading cybersecurity experts.
Initial actions to prevent further unauthorized access appear to have been successful, with no further unauthorized activity detected.
Impact on customers
The company warned customers of potential effects on system availability, including intermittent service degradation, but said it does not believe customers need to take action and is not proactively disconnecting systems. In an August 29 update, McKesson said it continues to serve customers across all lines of business, orders are being accepted, and distribution centers remain open. McKesson has yet to determine whether the incident is material to its financial condition or results of operations.
ShinyHunters is known for data theft and extortion, typically gaining access through voice phishing and social engineering. Previous healthcare victims include Medtronic, Abbott Laboratories, iRhythm, AdaptHealth, and DentaQuest.
In the days before the McKesson claim, ShinyHunters also claimed responsibility for a data theft at Baxter International. BleepingComputer reported that around 1 terabyte of data was exfiltrated between August 21 and August 25, 2026, with a ransom demand of more than $55 million issued.
The practical upshot for McKesson’s customers: the company says no action is needed on their part right now, but the full scope of what was taken — and who is behind it — remains an open question as investigators work through what appears to be an enormous cache of records.
