ShinyHunters, an extortion group, says it stole 284 million records from McKesson, one of the largest pharmaceutical distributors in the United States. McKesson has confirmed that data was taken. It has not named the group.
The number needs a caveat. It counts rows of raw data, not people. Think of a spreadsheet: one patient can fill dozens of lines. Troy Hunt of HaveIBeenPwned later reported that the data included 6.4 million unique email addresses, drawn from marketing campaigns, patients, staff and others.
What McKesson has said
McKesson told the SEC in a Form 8-K that it first detected the incident on August 25, 2026, and announced it on August 28. It called it “a cybersecurity incident involving third-party applications and unauthorized access and exfiltration of data.” The company said early findings point to a subset of customers in its Oncology & Multispecialty and Medical-Surgical units, and that its first steps to block further access appear to have worked.
Customers were warned of possible slowdowns, including intermittent service degradation. They were also told they need not do anything, and that McKesson was not unplugging systems. An update on August 29 said orders were still being accepted and distribution centers were open. Whether the incident is material to the company’s finances is undecided.
On September 8, McKesson said the exposed information likely included names, addresses, phone numbers, email addresses, patient IDs and dates of birth. Depending on the person, it may also include insurance details such as Medicaid or Medicare IDs, diagnoses, medications, test results, claim and card numbers, or Social Security numbers.
How the group says it got in
ShinyHunters told BleepingComputer it phoned McKesson employees and talked them out of single sign-on credentials. It said it then reached the Salesforce and Snowflake environments and pulled about 1 terabyte between August 21 and 25. The group demanded $55,236,150 and gave a 72-hour deadline, according to the Propelex analysis. McKesson did not respond, and the data was posted on the group’s leak site.
The group has hit healthcare before, including Medtronic, Abbott Laboratories, iRhythm, AdaptHealth and DentaQuest. In the days before the McKesson claim, it also claimed a theft at Baxter International.
Sources
- McKesson Cyberattack: Stolen Data Includes 6.4 Million Unique Email Addresses
- McKesson Data Breach 2026: What ShinyHunters Did | Propelex
