The attackers did not break into McKesson’s core network. By the group’s own account, they rang its employees.
ShinyHunters told BleepingComputer it voice-phished several staff members, then used compromised Okta single-sign-on accounts to get into the company’s Salesforce and Snowflake environments. It claims to have removed roughly 1 TB between August 21 and 25. McKesson has not verified that account. It said only that it found the incident on August 25, 2026, and that its investigation was at an early stage.
The group’s leak-site listing claims hundreds of millions of records, which BleepingComputer put at about 284 million. That is a count of records, not of unique patients. McKesson has given no figure for the amount or type of data taken.
What the company did say, in its statement: “we’ve confirmed that the unauthorized access to certain third-party applications and the exfiltration of certain data was associated with a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units.”
Malwarebytes, which reported the story, pointed to the downstream danger. Names and identity details paired with health information make convincing bait. A scammer could pose as a pharmacy, insurer, debt collector or provider and invent a prescription problem, an unpaid claim or a changed appointment. McKesson has not confirmed that any specific category of patient data was accessed.
For people worried about their own exposure, the advice is ordinary: check what McKesson says, change passwords, turn on two-factor authentication (a FIDO2 key can’t be phished), and verify through a separate channel before answering anyone who contacts you.
