ShinyHunters Claims 284 Million Records From McKesson as Healthcare Breach Grows

McKesson, one of the largest healthcare distributors in North America, has confirmed that intruders accessed and exfiltrated data from its systems, days after the ShinyHunters extortion group claimed it had pulled records covering as many as 284 million patient entries. The company disclosed the incident in a Form 8-K filing with the U.S. Securities and Exchange Commission and confirmed that it is investigating.

Related reading: Dutch Police Arrest Alleged ShinyHunters Leader as FBI Breach Fallout Grows · Sony's Japanese ISP Arm Says a Breach Exposed 2.6 Million Records.

The numbers are extraordinary, and so is the way the intrusion is said to have unfolded: not through a software vulnerability, but through a phone call. According to BleepingComputer and CyberInsider, ShinyHunters told reporters it used voice phishing (vishing) to trick employees into handing over credentials, then used those logins to take over Okta single sign-on accounts. From there, the group said it moved into the company's Salesforce and Snowflake environments and exfiltrated about a terabyte of data over four days, between Aug. 21 and Aug. 25.

McKesson said it first detected the incident on Aug. 25. In its public notice, the company described "a cybersecurity incident involving third-party applications and unauthorized access and exfiltration of data," and said the incident appears to involve data relating to "a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units."

The 284 million number, unpacked

The single most important caveat in this story is that 284 million is not 284 million people. ShinyHunters initially fed headlines suggesting that many patients were affected; the group later clarified to BleepingComputer that the figure is a raw count of roughly 284 million records or rows, and that it has not analysed the haul closely enough to know how many unique individuals are in it. One patient typically appears in many rows (appointments, prescriptions, invoices, communications) so the true number of people is almost certainly lower, though the practical exposure may still be enormous.

ShinyHunters says the data includes names, addresses, dates of birth, Social Security numbers, patient IDs, phone numbers, email addresses, Medicaid numbers, medical record numbers, medication and allergy information, illnesses and diagnoses, appointment details, and physician information. It also claims to hold employee records, billing and prescription data, internal communications, and what CyberInsider described as doctor-patient email content, though not attachments. None of this has been independently verified, and McKesson has declined to confirm the specific data types or the number of people affected.

From a phone call to a cloud warehouse

The mechanics matter because they recur across almost every ShinyHunters campaign. Vishing bypasses technical controls by targeting people: an attacker poses as an IT help desk, persuades an employee to read back a one-time code or approve a push notification, and inherits that employee's identity in the identity provider. Once inside Okta, the attacker can often reach whatever that identity is entitled to, in this case, the SaaS applications where sensitive business data lives.

Snowflake and Salesforce occupy a special place in this playbook. Both are widely deployed, both concentrate vast amounts of customer data, and both are accessible with stolen credentials if an organisation has not layered in strong, phishing-resistant authentication and tight access reviews. Security researchers have spent much of the past year warning that data-theft crews have learned to skip ransomware encryption entirely and simply copy the data out of cloud warehouses, then extort the victim over the threat of publication. ReliaQuest, which tracked the campaign, reportedly noted that ShinyHunters was using lookalike domains following the .claims pattern that name the target.

ShinyHunters told BleepingComputer it demanded $55,236,150 and gave McKesson 72 hours to respond. The group said the company never answered.

Why healthcare keeps getting hit

McKesson sits at the centre of the U.S. drug supply chain, delivering roughly one-third of prescription medicines to hospitals, pharmacies, and clinics, and operating the Health Mart pharmacy franchise. That makes it a rich target for reasons that go far beyond its own balance sheet: the data it holds is a combination of identity information, clinical detail, and financial records, which is exactly the profile attackers want for both extortion and downstream fraud.

The company is also the latest name in a run of healthcare breaches attributed to ShinyHunters or groups using similar tactics, which have reportedly included Abbott Laboratories, Baxter International, Medtronic, DentaQuest, and Amazon's legacy One Medical systems. The pattern suggests a professionalised supply chain of intrusion: cheap identities, cloud data lakes, and publication-based leverage, repeated at industrial scale against an industry that runs on legacy systems and thin margins.

The most valuable dataset in healthcare is not a single record. It is the ability to join identity, condition, and prescription data into one picture of a person, and that is exactly what a distribution middleman holds.

The extortion playbook is the real lesson

Ransomware once meant locked files and a decryption key. The ShinyHunters model is simpler and, from the attacker's perspective, more efficient: steal a copy, threaten to publish, and negotiate from the assumption that the victim's greatest fear is regulatory and reputational, not operational. The European Union's GDPR and U.S. state breach-notification laws turn publication into a concrete liability. That is why the group's deadline (and McKesson's apparent silence) is the part to watch.

It is worth being precise about what "data theft" means here. If the exfiltrated material includes Social Security numbers, Medicaid numbers, and detailed diagnoses, the harm unfolds over years: identity theft, medical billing fraud, and highly convincing phishing that can cite a real prescription or appointment. Unlike a credit card number, a diagnosis cannot be reissued. That asymmetry is what makes healthcare data uniquely dangerous and uniquely valuable.

A familiar script, run at scale

ShinyHunters is not new. The group has been linked to high-profile data theft for years, and its recent campaigns have coalesced around a repeatable formula: social-engineer an identity, pivot into a SaaS tenant, and exfiltrate from a cloud data platform. The shift from encryption-based ransomware to pure theft-and-extortion strips out the hardest part of the criminal supply chain (maintaining and operating a working encryption tool and negotiating infrastructure), while keeping most of the leverage, because the threat to publish is what actually moves victims.

The cloud data warehouse has become the preferred exit. In 2025, a wave of Snowflake account compromises forced scores of large organisations to disclose data theft, and the lessons from that wave (enforce strong authentication, restrict network access, audit dormant accounts, and watch for unusual export volumes) are the same ones that apply here. Salesforce, meanwhile, is the system of record for customer relationships and often accumulates far more sensitive detail than teams expect, including support notes and communications. When an attacker can read both, the resulting dataset is not a leak of one system; it is a profile of a business.

There is a second-order risk that gets less attention: the data broker's market for stolen records. ShinyHunters does not exist in isolation, and stolen healthcare datasets have a long afterlife in fraud ecosystems even when a ransom is paid or a leak site is taken down. That is why the standard advice (freeze credit, watch for medical billing you do not recognise, be suspicious of communications that reference real personal details) remains relevant for a long time.

The regulatory clock is already running

McKesson's SEC filing is itself a signal. Public companies are expected to disclose material cybersecurity incidents, and the language McKesson used ("early stages," not yet material) is the standard starting position while forensic work continues. That assessment can change. Under the U.S. HIPAA breach-notification rule, affected individuals generally must be notified within 60 days of discovering a breach of unsecured protected health information, and state attorneys general have their own, sometimes shorter, timelines and their own notification requirements. With a dataset this broad, the notification exercise alone will be enormous.

The breach also lands during a period of heightened regulatory attention to healthcare cybersecurity, after a string of attacks on medical device makers, hospital systems, and claims processors. Regulators and lawmakers have repeatedly asked why an industry that holds the most sensitive category of personal data has been so slow to adopt phishing-resistant authentication and cloud data governance. McKesson's case will become another data point in that argument.

What to watch

Three things will determine how this resolves. First, McKesson's investigation: whether it can establish the true number of affected individuals and begin the notification process required by state laws and, potentially, HIPAA. Second, whether the company's "no action required" guidance holds up or is revised. That language tends to soften once forensic firms finish their work. Third, whether the industry treats this as a cloud-identity problem rather than a McKesson problem. The specific victim will change; the playbook will not.

There is also the question of the ransom deadline. Extortion groups typically escalate from a missed deadline to partial leaks designed to pressure the victim and prove the data is real. Whether ShinyHunters follows through, and how McKesson responds, will shape the next phase of the story. For now, the company's position is that operations are normal and customers need not act, a claim that is reasonable to take at face value, but not one to rely on without watching the record closely.

For defenders, the signal is blunt. Phishing-resistant multi-factor authentication on identity providers such as Okta, least-privilege access to data warehouses like Snowflake, and monitoring for bulk data exports are no longer advanced measures. They are the baseline that separates a bad week from a 284-million-row catastrophe. The uncomfortable truth of this breach is that none of it required a novel exploit, only a phone call and a set of credentials that should never have been enough.