McKesson discovered a cybersecurity incident on 25 August 2026 and disclosed it in an 8-K filed on 28 August under Item 7.01, Regulation FD. The company said the investigation was at an early stage and that it had not determined the incident to be material. This post separates what McKesson has said from what the extortion group ShinyHunters claims, because the two are often blended in headlines.
What's affected
Confirmed by McKesson, per the coverage we reviewed:
- Unauthorized access to certain third-party applications and exfiltration of certain data.
- A 29 August update tied the incident to a subset of customers in its Oncology and Multispecialty and Medical-Surgical business units.
- The company said it had reasonable assurance of no ongoing unauthorized activity, told customers no action is required and is not disconnecting systems.
Not confirmed by McKesson: which applications, how access was gained, what data was taken, or how many people are affected.
Claimed by ShinyHunters and unverified, as relayed by BleepingComputer: voice phishing of employees, compromise of Okta single sign-on accounts, then access to Salesforce and Snowflake, and about 284 million records. The group told BleepingComputer the figure is a raw row count and not unique individuals.
What to do now
- If you are a McKesson customer, follow the company's own page for updates and ask your account contact which of your data sat in the affected applications.
- Whatever the cause turns out to be, audit your own SaaS estate: which third-party applications hold regulated data, who can reach them, and which sign-in path protects them.
- Check help desk procedures for password and MFA resets. Voice phishing targets that process.
- Review exports and API tokens in your data warehouse and CRM, and revoke any you cannot explain.
How this could have been avoided
McKesson has not said how access occurred, so these controls apply if the attacker's account is accurate, and are worth having either way.
- Use phishing-resistant MFA, such as passkeys or hardware keys, for SSO accounts. A one-time code read over the phone is what voice phishing is built to capture.
- Verify callers before resets. A help desk should call back on a number from the directory, not the number that called in.
- Limit what one identity can reach. If an SSO account opens both the CRM and the warehouse, one phone call opens both.
- Alert on bulk reads and exports from the warehouse, and cap export size per user.
Quick check
Which McKesson statements are attacker claims rather than company confirmations?
The 284 million figure, the voice phishing and Okta path, the Salesforce and Snowflake access and the ransom demand all come from ShinyHunters. McKesson has confirmed only third-party application access and data exfiltration.
