Breaches · 42 days ago
McKesson said on Aug. 25 that attackers exfiltrated data from third-party applications tied to customers in its Oncology & Multispecialty and Medical-Surgical businesses, while ShinyHunters said it stole and listed 284 million patient records. The company says its distribution and core services are still running, even as the incident moves from disclosure into an extortion and public-release phase.
The apparent path was human-led rather than a direct app break: ShinyHunters told reporters it used phone-based social engineering to steal employee credentials, then entered McKesson through normal single sign-on and cloud app screens. That matters because the access looked legitimate, so the theft could continue through everyday tools without taking down the company’s operations.
For healthcare organizations that keep service up while isolating affected SaaS and integrations, the exposure can still persist in criminal hands after the outage risk is contained. If the stolen data includes patient, billing, and employee records as claimed, the lasting harm is misuse and leak pressure, not just the initial intrusion.
9 sources covering this story
Healthcare Giant McKesson Investigates Data Breach Incident
ShinyHunters claims to have stolen 284 million records from McKesson
Healthcare cyberattacks hit pacemakers and millions of patient records
McKesson admits breach as ShinyHunters demands $55.2M
Hackers Frequently Target Healthcare and Finance Orgs | Huntress
Healthcare organizations and banks handle highly personal information. But a new Huntress survey shows many threat actors frequently target these companies.
McKesson copes with fallout from data theft extortion attack
The major healthcare sector vendor did not identify the attackers, but ShinyHunters, a prolific group increasingly targeting the sector, claimed responsibility.
The company, which distributes medicines and medical devices to hospitals and healthcare practices across the U.S., said it was hacked and expects intermittent service degradation.
McKesson Confirms Data Breach as Attacker Deadline Looms
The ShinyHunters extortion group has claimed the theft of 284 million records from the company’s systems.
The Record from Recorded Future
Pharmaceutical giant McKesson warns of 'service degradation' following cyberattack
The pharmaceutical and healthcare technology company McKesson informed regulators it is in the early stages of investigating a cybersecurity incident involving an unnamed third-party application.
ShinyHunters claims it stole 284 million patient records from McKesson - Help Net Security
Healthcare company McKesson confirms a data breach as ShinyHunters claims it stole 284 million patient records.
McKesson discloses breach after ShinyHunters claims patient data theft
Healthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming it stole 284 million patient data records.
Part of the PlainSec briefing for 2026-09-02