WASHINGTON, Sept. 3 — McKesson Corporation is wrestling with a cybersecurity incident that has put tens of millions of patient records at risk, with the extortion group ShinyHunters claiming responsibility for a data theft the company disclosed to regulators late last month.
The healthcare and pharmaceutical giant filed a Form 8-K with the U.S. Securities and Exchange Commission on August 28 stating it had experienced “a cybersecurity incident involving third-party applications and unauthorized access and exfiltration of data.” McKesson said the incident was first detected on August 25, and while it confirmed data was taken, the full extent of the theft has not yet been determined. ShinyHunters has added McKesson to its data leak site, claiming 284 million patient data records were exfiltrated.
That figure refers to rows of raw data rather than unique patients, but the breach is nonetheless significant. The group claims the stolen information includes names, contact information, Social Security numbers, dates of birth, medical record numbers, Medicaid numbers, medication and allergy details, diagnoses, appointment information and other sensitive data.
What was hit
Under the hood, the data appears to relate to McKesson’s Salesforce environment and Snowflake. Based on early investigation results, the incident involves data relating to a subset of customers of its Oncology & Multispecialty and Medical-Surgical business units. McKesson has activated incident response protocols and engaged leading cybersecurity experts to assist.
The company has not publicly identified the attacker, though ShinyHunters’ claim is widely reported. The group, a prolific threat actor known for data theft and extortion, typically gains access through voice phishing and social engineering, and has previously targeted healthcare organisations including Medtronic, Abbott Laboratories, iRhythm, AdaptHealth and DentaQuest.
The technical reality is that ShinyHunters has been busy. In the days before the McKesson claim, the group also claimed responsibility for a data theft at Baxter International. According to BleepingComputer, which has been in contact with the group, around 1 terabyte of data was exfiltrated from Baxter between August 21 and August 25, 2026, and a ransom demand of more than $55 million was issued.
Current status
In an August 29 update, McKesson said it continues to serve customers across all lines of business, orders are being accepted, and its distribution centers remain open, with products continuing to be shipped. The company has warned customers there may be an impact on system availability and business operations, including intermittent service degradation, but it does not believe customers need to take any action and is not proactively disconnecting systems.
McKesson has not yet determined whether the incident is material and will have a material impact on its financial condition or results of operations. The investigation is ongoing.
As ever with these disclosures, the detail that matters is what the investigators find in the exfiltrated data — and whether ShinyHunters’ 284 million figure holds up under scrutiny. The reporting is based on work by The HIPAA Journal, which noted a correction regarding an earlier erroneous link to Boston Scientific.
