Healthcare Giant McKesson Hit by Massive Cyberattack
Tap title to read story
Healthcare and pharmaceutical distributor McKesson disclosed a cybersecurity incident on August 31, 2026, involving unauthorized access to and data exfiltration from a third-party application [citation:8]. The company filed an 8-K with the SEC, stating the intrusion was detected on August 25 and is under investigation [citation:3]. Cybercriminal group ShinyHunters claimed responsibility, asserting they stole approximately 284 million data rows—roughly one terabyte—between August 21 and 25 [citation:3][citation:5]. The group reported using voice phishing to compromise employee Okta accounts, gaining access to Salesforce and Snowflake environments [citation:5][citation:7]. An extortion demand exceeding $55 million has been issued, with a deadline of September 1 [citation:1][citation:5]. McKesson warned that customers in its Oncology & Multispecialty and Medical-Surgical units may experience service degradation but stated it has not yet determined the incident to be financially material [citation:1][citation:7]. The compromised data allegedly includes sensitive patient information such as Social Security numbers and medical records [citation:2][citation:4]. The company is working with external cybersecurity experts and has established a dedicated information page at mckesson.com/cybersecurity [citation:3][citation:8].
Timeline
- On August 21 2026 ShinyHunters allegedly began exfiltrating data from McKesson systems [citation:3][citation:5].
- On August 25 2026 McKesson discovered the unauthorized access and data breach [citation:1][citation:3].
- On August 25 2026 ShinyHunters allegedly completed data theft and issued ransom demand [citation:5].
- On August 28 2026 McKesson filed an SEC 8-K form and published customer notice [citation:3][citation:8].
- On August 28 2026 ShinyHunters added McKesson to its Tor-based leak site [citation:1].
- On August 29 2026 ShinyHunters claimed responsibility for the cyberattack [citation:3].
- On August 31 2026 McKesson investigation ongoing with leading cybersecurity experts [citation:8].
- On September 1 2026 ShinyHunters' reported 72-hour ransom deadline is expected [citation:1].
- McKesson will likely provide more details on the breach's full scope [citation:3]
- Class-action lawsuits from affected patients and regulatory investigations are probable [citation:2]
Sources
The Record from Recorded Future News
JQJO Editorial Desk · Human reviewed · AI assisted. Report a correction.

























