Healthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft. The ShinyHunters extortion group is claiming responsibility, telling BleepingComputer it stole roughly 284 million patient-related records — approximately one terabyte of data — from McKesson’s Salesforce and Snowflake environments between August 21 and August 25, 2026.
McKesson discovered the breach on August 25 and disclosed it in a Form 8-K filing with the SEC. According to ShinyHunters, the attackers gained access through voice phishing (vishing) attacks against multiple McKesson employees, compromising their Okta single sign-on accounts. The threat actor claims it fully compromised the company’s Salesforce environment, including support cases, and exfiltrated a much larger dataset from Snowflake. Researchers at ReliaQuest had previously documented a ShinyHunters campaign registering company.claims domains to impersonate corporate help desks — the domain mckesson[.]claims fits that pattern exactly. McKesson’s investigation is in early stages and the company says it has not yet determined whether the incident is material to its operations, though customers may see intermittent service disruptions.