McKesson's 8-K locates the stolen data inside third-party applications
The distributor found the intrusion on August 25, 2026, the same day ShinyHunters says its four-day exfiltration ended. It has not named the vendor applications involved, so customers are left scoping their own integrations.
The Watch · Security desk
What happened
- McKesson told the SEC in a Form 8-K that it discovered a cybersecurity incident on August 25, 2026, and that its investigation remains in the early stages.
- A separate notice to customers confirmed the incident involved third-party applications and the unauthorized access and exfiltration of data, with scope still undetermined.
- The group says it removed about 1TB of data over four days, between August 21 and August 25, including full access to Salesforce support cases.
Why it matters
- Who's exposed exposure If the account holds, the reachable surface for any healthcare supply chain firm running the same pattern is every SaaS tenant its identity provider trusts, reached with valid sessions rather than exploits.
- What it limits constraint Without named applications, downstream pharmacies and providers cannot scope their own exposure and are left inventorying what they federated and shared, not what McKesson lost.
- Who has to decide decision Customers absorbing intermittent service degradation have to decide for themselves whether to pause integrations while the vendor keeps its own systems connected.
- What doesn't add up contradiction The only volume figures in circulation come from the extortionist. The record-versus-patient distinction changes the notification math for every covered entity reading this.
Next story · Security · 3d ago
Phase Eight, Hobbs and Whistles owner discloses a cyber incident a week after AsosConfirmed9 publishers
Two accounts sit side by side, and they should be read separately. McKesson's own filing and customer notice confirm an incident discovered on August 25, 2026 [2], unauthorized access to third-party applications, and exfiltration of data [3]. The company has not said which applications, how access was obtained, or what was taken [9]. Everything about mechanism comes from the extortionist: ShinyHunters told BleepingComputer it ran vishing against multiple employees, took over their Okta single sign-on accounts, and used those to reach Salesforce and Snowflake [5][7]. It claims the Salesforce environment including support cases, and a larger patient-related set out of Snowflake [16].
The volume claim is checkable against itself. About 1TB moved between August 21 and August 25 [11], and roughly 284 million records is a raw line count rather than a count of people, per ShinyHunters' correction to earlier reporting [8]. Divide: 1e12 bytes over 2.84e8 records averages about 3.5 KB each [18]. Since the terabyte also carries the Salesforce case data, the true per-row average for the Snowflake set is lower still [18]. That is the size of tabular rows, not of patient files with attachments. ShinyHunters says it has not analyzed the data and does not know the unique-individual count [10], so nobody currently has a defensible number for how many patients are involved.
The timeline lines up too neatly to ignore. The claimed transfer window closes on the same date McKesson gives as its discovery date [17], which puts detection at the end of four days of egress averaging roughly 250 GB per day [19]. Whether the discovery interrupted the transfer or merely observed its finish is not in the public record [9].
The initial access route matches a known campaign pattern. A second BleepingComputer source identified mckesson[.]claims as part of the campaign [14], and ReliaQuest said it is tracking widespread ShinyHunters registration of company[.]claims domains carrying a target's name or abbreviation to impersonate help desks and IT [15]. That gives cheap detection material for anyone else in the healthcare supply chain: newly registered .claims domains matching your name, help desk reset volume, and bulk export rates in Salesforce and Snowflake tenants federated to the same identity provider.
Nothing in either account describes malware or a vulnerability [9][7]. Endpoint hardening does not touch this chain. The reachable set is whatever the SSO entitlement trusts, so the inventory that matters is which third-party applications hold patient data, which of them sit behind the same IdP, and what query and export ceilings exist inside each one. McKesson meanwhile says materiality is undetermined and that it is not proactively disconnecting systems, while warning customers of intermittent service degradation tied to the attack [13][4].
What to watch
- Whether McKesson names the third-party applications, which is what customers need to scope their own tenants.
- Whether the 8-K is amended to a materiality determination, and whether patient notification obligations follow.
- Whether ShinyHunters publishes a sample or produces a unique-individual count for the 284 million records.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+40
- Incentives70
- Confidence55
Perspective Coverage
9 publishers- Builder
- Builder 17%
- Operator
- Operator 66%
- Investor
- Investor 17%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
McKesson disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming it stole 284 million patient data records.
- [2]
McKesson says it discovered the cybersecurity incident on August 25, 2026, and that its investigation remains in the early stages.
- [3]
In a separate notice to customers, McKesson confirmed the incident involved third-party applications and the unauthorized access and exfiltration of data.
- [4]
McKesson warned that customers may experience intermittent service degradation believed to be related to the attack, and said it was not proactively disconnecting systems within its environment.
- [5]
ShinyHunters told BleepingComputer it was behind the attack and gained access after conducting voice phishing social engineering attacks against multiple McKesson employees.
- [6]
McKesson is a major U.S. healthcare company and pharmaceutical distributor providing medicines, medical supplies, technology and services to healthcare providers and pharmacies.
- [7]
ShinyHunters told BleepingComputer the vishing attacks led to the compromise of multiple employees' Okta single sign-on accounts, which were then used to access McKesson's Salesforce and Snowflake environments.
- [8]
ShinyHunters clarified to BleepingComputer that the approximately 284 million figure is a raw count of data records or lines from the Snowflake data rather than a count of unique individuals; previous reporting had stated information belonging to 284 million patients was exposed.
- [9]
McKesson has not publicly disclosed which third-party applications were compromised, how the attackers gained access, or what information was stolen.
- [10]
ShinyHunters told BleepingComputer it has not fully analyzed the stolen data and does not know how many unique people are in the records.
- [11]
According to ShinyHunters, the group exfiltrated about 1TB of data over four days, between August 21 and August 25.
- [12]
CyberInsider first reported the breach, and McKesson later disclosed it in a Form 8-K filing with the U.S. Securities and Exchange Commission.
- [13]
McKesson said in its SEC filing that as of the filing date it has not determined the incident is material or reasonably likely to have any material impact on the company, including its financial condition or results of operations.
- [14]
ShinyHunters declined to provide many technical details including the domain used, but BleepingComputer learned from another source that the threat actors used the mckesson[.]claims domain as part of the attack.
- [15]
ReliaQuest said in a now-deleted post on X that it is tracking a widespread ShinyHunters campaign using domains following the company[.]claims pattern, incorporating the target organization's name or abbreviation under the .claims TLD to impersonate help desks and IT teams.
- [16]
ShinyHunters claims it fully compromised the Salesforce environment including support cases, and separately stole a much larger collection of patient-related data from Snowflake.
- [17]
McKesson's stated discovery date of August 25, 2026 is the same date as the final day of ShinyHunters' claimed exfiltration window, placing detection at the end of four days of egress.
- [18]
If the claimed 1TB corresponds to the claimed 284 million records, the average record is about 3.5 KB; because the terabyte also includes the Salesforce case data, the actual average size of a Snowflake row is lower.
- [19]
The claimed 1TB over four days averages roughly 250 GB of egress per day.
Sources
9 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comMcKesson discloses breach after ShinyHunters claims patient data theft
1 article · August 28, 2026
- cyberscoop.comMcKesson copes with fallout from data theft extortion attack
2 articles · September 2, 2026
- helpnetsecurity.comShinyHunters claims it stole 284 million patient records from McKesson
1 article · August 31, 2026
- infosecurity-magazine.comHealthcare Giant McKesson Investigates Data Breach Incident
1 article · September 1, 2026
- malwarebytes.comMcKesson confirms cyber incident after ShinyHunters claims patient-data theft
1 article · August 31, 2026
- Cybersecurity
mckesson.com
1 article · September 2, 2026
- scworld.comMcKesson discloses data breach after ShinyHunters claims theft of 284 million records
1 article · August 31, 2026
- securityweek.comMcKesson Confirms Data Breach as Attacker Deadline Looms
1 article · August 31, 2026
- therecord.mediaPharmaceutical giant McKesson warns of 'service degradation' following cyberattack
1 article · August 31, 2026