On 25 August 2026, McKesson — one of the largest pharmaceutical distributors in the world, and a company that touches a very large share of the prescriptions dispensed in the United States — detected an intrusion and filed a Form 8-K with the SEC the same day. The filing describes an investigation in its “early stages,” incident response protocols activated, outside experts engaged, and the possibility of “intermittent service degradation.”
That is the confirmed part. Everything larger comes from the attackers.
ShinyHunters told BleepingComputer it exfiltrated roughly 1 terabyte of data between 21 and 25 August, that the haul amounts to about 284 million records, and that it demanded $55,236,150 with a 72-hour deadline. It says McKesson never replied.
None of that has been independently verified, and the number deserves immediate scepticism — more on that below. What is worth your attention is how they got in, because it is the same way they have got into everything else this year.
The Entry Point Was a Phone Call
According to the group, the initial access was voice phishing. Attackers registered a lookalike domain — mckesson[.]claims — and called employees while impersonating the internal help desk and IT support. The goal was not malware. It was to talk staff through handing over Okta single sign-on credentials and the multi-factor step that protects them.
With Okta compromised, they had the keys to the things Okta unlocks. In McKesson’s case that reportedly included the Salesforce tenant — including support cases, which are where customers and patients write down the things they would never put in a form — and Snowflake, the data warehouse.
There is no exploit in this chain. There is no unpatched appliance. There is a person, a telephone, and a federated identity system doing exactly what it was designed to do for whoever holds the credential.
This is the pattern we described in the Oracle zero-day breach wave and again in the Instructure Canvas student data breach. The target is never the enterprise perimeter any more. It is the SaaS tenant behind the SSO, and the way in is a conversation.
What Was Allegedly Taken
ShinyHunters lists: names, addresses, dates of birth, Social Security numbers, patient identifiers, Medicaid details, medical record numbers, medication and allergy information, prescribing physician information, plus internal Salesforce support records and employee data.
If that inventory is accurate even in part, it is close to the worst combination available in a single dataset. A Social Security number is a permanent identifier. A medication list is a diagnosis in disguise — an antiretroviral, an antipsychotic, a hormone therapy, or an oncology regimen tells a reader what a patient has without a diagnosis code ever being present. And a prescribing physician’s name narrows a person to a city and a specialty.
You can reissue a card. You cannot reissue the fact that you filled a particular prescription in 2024.
About That 284 Million
Treat the headline number as a claim, not a count.
ShinyHunters itself has said it has not finished analysing the data, and the figure refers to rows of raw data, not unique patients. A single person moving through a distribution and support system generates many rows — one per case, per order, per correction, per duplicate record across merged systems.
There is a sharper reason for scepticism, and it comes from the same crew, the same month. When ShinyHunters dumped Carhartt’s data on 13 August it claimed roughly 25 million accounts. Independent analysis found 12,933,413 genuine accounts — the rest was synthetic filler injected to inflate the total. We look at that in detail in the Carhartt count.
Padding the number is a negotiating tactic. It raises the apparent stakes during extortion and it raises the group’s status afterwards. Assume the real figure is smaller. Assume it is still very large.
Why Healthcare Distribution Is a Uniquely Bad Place for This
McKesson is not a hospital. Most people whose data may be in this incident have never heard of the company and have no relationship with it — which means they were never in a position to evaluate its security, consent to it holding their information, or take their business elsewhere.
That is the structural problem with the middle of the healthcare supply chain. The entity holding the data is not the entity the patient chose. Pharmacy benefit managers, distributors, claims clearinghouses, revenue-cycle vendors and support-platform providers accumulate PHI at national scale precisely because they sit between the parties who do have relationships.
We saw the same shape in the ITRC’s H1 2026 report: the record-setting incidents are increasingly at intermediaries, and the exposure per incident keeps climbing because intermediaries aggregate.
HIPAA calls these business associates and requires contracts with them. A contract is not a control.
What Should Actually Change
The lesson from this month is not “train your staff harder.” Help-desk impersonation works on trained people; it works on security teams; it has worked on the companies with the largest security budgets on earth.
The controls that actually break this chain are structural:
- Phishing-resistant MFA — hardware-backed passkeys or FIDO2 security keys. A code someone can read aloud to a caller is a code an attacker can use. A key bound to the origin cannot be socially engineered over the phone.
- A help desk that never initiates credential recovery. Reset flows should be verifiable out-of-band by the employee, in a direction the employee controls.
- Limits on what one SSO identity unlocks. Salesforce and Snowflake should not fall to the same credential without a second, separate authorisation for bulk export.
- Egress alarms on the data warehouse. A terabyte left over four days. Four days is a very long time to move that much data without anything asking why.
What To Do If You Are a Patient
- Do not wait for a notification letter. McKesson’s investigation is early, and if the data is patient-level it will be many months before individual notices go out. Act on the assumption, not the confirmation.
- Freeze your credit at all three bureaus. Equifax, Experian and TransUnion. It is free, it takes about ten minutes each, and it is the only measure that meaningfully blunts a stolen SSN. Credit monitoring tells you after; a freeze prevents.
- Request an accounting of disclosures from your pharmacy and provider. Under HIPAA you can ask who your PHI was shared with. It will not be complete, but it tells you which intermediaries are in your chain.
- Expect targeted pretexting, not generic spam. Someone holding your medication list can call you and sound exactly like your pharmacy. Never confirm details to an inbound caller — hang up and dial the number on the label.
- Watch for medical identity theft specifically. Read your explanation-of-benefits statements. Care you never received, appearing in your record, is both a financial problem and a clinical one.
The uncomfortable part is that none of these are fixes. They are mitigations for a decision you were never asked to make, by a company you never chose, about data you could not withhold.
