What happened (short version)

Healthcare giant McKesson disclosed a cybersecurity incident that it says involved unauthorized access to third‑party applications and the theft of data. The company detected the activity on August 25, 2026, opened an investigation and said it’s working with outside experts. McKesson warned customers they may see intermittent service hiccups while the probe continues and has not yet said which vendors or apps were involved.

Meanwhile, the extortion group ShinyHunters claims responsibility and says the attackers used social engineering (voice phishing or “vishing”) to compromise employee accounts and move around McKesson’s cloud systems.

  • Attackers claim to have compromised Okta single‑sign‑on accounts and then accessed Salesforce and Snowflake environments.
  • They say roughly 1TB of data was taken over a few days (August 21–25) and that the haul contains about 284 million data records — a raw line count, not necessarily unique people.
  • The group says it asked for a ransom $55,236,150 and gave McKesson 72 hours to respond; according to the group, no negotiations happened.

McKesson’s public filings and customer notice confirm an incident and an ongoing investigation, but the company has not publicly confirmed what specific records were taken or whether the event will be considered material to its business.

Why it matters — and what you can do (without panicking)

If the claims are accurate, this is one of those big, messy healthcare data incidents people hate: lots of records, potentially sensitive personal and medical details, and the usual fun of dealing with social‑engineered access. The group says the stolen files include names, addresses, dates of birth, Social Security numbers, patient IDs, contact info, medical details, prescriptions, invoices, and even info about providers and clinics. Neither McKesson nor independent parties have verified the full contents yet, so treat these as alarming claims rather than gospel.

Practical steps for patients, providers, and partners:

  • Monitor accounts and statements for strange activity (medical bills, insurance surprises, unfamiliar lab orders).
  • Be suspicious of unexpected calls or messages asking for personal info—vishing is apparently involved, so verify callers through official channels before sharing anything.
  • If you or your organization use McKesson services, ask your IT/security team what they’ve learned and whether any credentials should be rotated.
  • Turn on strong multi‑factor authentication wherever possible and avoid reusing passwords.
  • Consider signing up for credit and identity monitoring if you believe your personal identifiers might have been exposed.

Bottom line: investigators are still digging, claims from the extortion gang are dramatic, and McKesson’s official word so far is cautious. Keep an eye on the company’s updates and treat outreach about your care or insurance with extra skepticism for now. And maybe don’t answer phone calls titled “We’re from IT” without a very strong pinch of suspicion.