TECHNOLOGY

Healthcare Giant McKesson Hit by Massive Cyberattack

PUBLISHED Aug 31, 2026, 10:36 AM ET

Read, Watch or Listen

Healthcare and pharmaceutical distributor McKesson disclosed a cybersecurity incident on August 31, 2026, involving unauthorized access to and data exfiltration from a third-party application [citation:8]. The company filed an 8-K with the SEC, stating the intrusion was detected on August 25 and is under investigation [citation:3]. Cybercriminal group ShinyHunters claimed responsibility, asserting they stole approximately 284 million data rows—roughly one terabyte—between August 21 and 25 [citation:3][citation:5]. The group reported using voice phishing to compromise employee Okta accounts, gaining access to Salesforce and Snowflake environments [citation:5][citation:7]. An extortion demand exceeding $55 million has been issued, with a deadline of September 1 [citation:1][citation:5]. McKesson warned that customers in its Oncology & Multispecialty and Medical-Surgical units may experience service degradation but stated it has not yet determined the incident to be financially material [citation:1][citation:7]. The compromised data allegedly includes sensitive patient information such as Social Security numbers and medical records [citation:2][citation:4]. The company is working with external cybersecurity experts and has established a dedicated information page at mckesson.com/cybersecurity [citation:3][citation:8].

By Daniel Hayes | JQJO News

Timeline of Events

On August 21 2026 ShinyHunters allegedly began exfiltrating data from McKesson systems [citation:3][citation:5].
On August 25 2026 McKesson discovered the unauthorized access and data breach [citation:1][citation:3].
On August 25 2026 ShinyHunters allegedly completed data theft and issued ransom demand [citation:5].
On August 28 2026 McKesson filed an SEC 8-K form and published customer notice [citation:3][citation:8].
On August 28 2026 ShinyHunters added McKesson to its Tor-based leak site [citation:1].
On August 29 2026 ShinyHunters claimed responsibility for the cyberattack [citation:3].
On August 31 2026 McKesson investigation ongoing with leading cybersecurity experts [citation:8].
On September 1 2026 ShinyHunters' reported 72-hour ransom deadline is expected [citation:1].
McKesson will likely provide more details on the breach's full scope [citation:3]
Class-action lawsuits from affected patients and regulatory investigations are probable [citation:2]

News Intelligence

Immediate US impact: Millions of patients face potential medical identity theft and privacy violations [citation:2]
Possible long-term US impact: This will accelerate federal healthcare cybersecurity mandates and compliance costs
Most affected groups: Patients of Oncology and Medical-Surgical units are most directly affected [citation:1]
Reader priority: Monitor credit reports and McKesson's official cybersecurity page for breach updates [citation:2][citation:8]