In short: On 25 August 2026, McKesson — one of the largest pharmaceutical distributors in the United States — detected unauthorised access to its systems. On 28 August, the company disclosed the incident via SEC Form 8-K. Ransomware group ShinyHunters claims to have stolen 1 TB of data containing 284 million patient record rows, including Social Security numbers, diagnoses, and prescriptions. McKesson has officially confirmed only the fact of the breach. Here is what is known and what it means for your personal data security.
Timeline: what happened and when
On 25 August 2026, McKesson detected anomalous activity in its systems. According to BleepingComputer, data exfiltration began the same day and continued over four days. On 28 August 2026, McKesson filed SEC Form 8-K — a mandatory disclosure for publicly traded companies following material events. Chief Information Officer Francisco Fraga confirmed: "Based on our investigation thus far...we've confirmed that the unauthorized access to certain third-party applications and the exfiltration of certain data was associated with a subset of customers."
McKesson did not disclose the total number of affected individuals, the specific types of data involved, or the names of compromised systems. The breach and exfiltration of customer data have, however, been officially confirmed. For more on how corporate breaches affect your personal data security, see the LiMP VPN blog.
The attack vector: vishing and Okta SSO compromise
According to BleepingComputer and Help Net Security, ShinyHunters disclosed the attack method: the operation began with voice phishing (vishing). Attackers called McKesson employees, posing as IT help desk staff, and used a decoy domain — mckesson[.]claims — mimicking the corporate support portal. The objective was to extract Okta SSO credentials.
Okta is a Single Sign-On platform that large organisations use to centralise access management across dozens of corporate services. Capturing a single set of credentials gave attackers simultaneous access to multiple systems — in this case, ShinyHunters claims: Salesforce and Snowflake.
Vishing bypasses most technical defences because it exploits human trust rather than software vulnerabilities. No antivirus, firewall, or intrusion detection system can reliably prevent an employee from following an attacker's instructions over the phone.
What ShinyHunters claims about the stolen data
Note: the following statements belong to ShinyHunters and have not been independently verified by McKesson or third-party researchers.
The group claims that over four days (21–25 August 2026) approximately 1 TB of data was exfiltrated — 284 million rows in the database. The hackers themselves note that this figure refers to database rows, not unique individual patients.
The alleged stolen data includes:
- Names, addresses, dates of birth;
- Social Security numbers (SSNs);
- Medicaid identifiers and medication records;
- Diagnoses, including terminal illness data;
- Prescriptions and medication shipment histories;
- Appointment records and healthcare provider data;
- Internal Salesforce records and McKesson employee data.
The ransom demand is $55,236,150 with a 72-hour deadline. As of 31 August 2026, the data had not been released publicly.
Why medical data is the most sensitive type of breach
Medical records fall into the most sensitive category of personal data. Unlike payment card information — which can be cancelled and reissued — data about diagnoses, chronic conditions, or disabilities cannot be changed. This creates several categories of long-term risk:
- Medical identity theft. Attackers use stolen data to obtain medical services, prescriptions, or insurance reimbursements in the victim's name. Victims typically discover this only when insurance coverage is denied or when debts appear for services they never received.
- Targeted blackmail. Information about cancer diagnoses, mental health conditions, or substance dependencies may be used to coerce individuals or organisations.
- Financial fraud. An SSN combined with a date of birth and address is sufficient to open credit accounts, take out loans, or file fraudulent tax returns in the victim's name.
- Long-term phishing leverage. Knowing a specific doctor's name, appointment dates, and medication creates the ideal pretext for convincing phishing that is indistinguishable from genuine clinic or insurer correspondence.
How to protect your data after a major breach
If you have ever been a McKesson customer or a patient at an affiliated healthcare organisation:
- Wait for an official notification. McKesson is legally required to notify affected customers directly. Do not respond to calls or emails "from McKesson" before that official notice arrives — secondary vishing follows primary breaches precisely because attackers already have enough data to sound credible.
- Check your email at HaveIBeenPwned and place a credit freeze with the major credit bureaus. A freeze is free in the US and prevents new accounts from being opened in your name.
- Enable multi-factor authentication. The Okta SSO compromise was the entry point into McKesson's systems. MFA — especially hardware security keys or a TOTP authenticator app — significantly raises the barrier against vishing attacks.
- Encrypt your traffic during remote work. Corporate breaches often begin with credential interception over unsecured channels. LiMP VPN encrypts all traffic from your device — particularly important when accessing corporate systems outside the office.