McKesson confirms data exfiltration; ShinyHunters claims vishing led through Okta to Salesforce/Snowflake and 284M records
McKesson has now confirmed a cybersecurity incident involving data exfiltration, while ShinyHunters is making much broader claims about how the attackers got in and what they obtained.
McKesson discovered the incident on August 25 and says unauthorized access involved third-party applications associated with a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units.
The company confirms that some associated data was exfiltrated.
The claimed attack chain is where things get interesting.
ShinyHunters told BleepingComputer that employees were initially targeted through voice phishing (vishing). The group says compromised Okta SSO accounts were subsequently used to access McKesson’s Salesforce and Snowflake environments.
ShinyHunters claims approximately 1 TB was exfiltrated between August 21 and August 25, comprising roughly 284 million records.
That number needs an important qualifier: Malwarebytes says it represents records/database rows and does not necessarily correspond to 284 million unique patients.
The group claims the stolen information includes names, addresses, DOBs, phone numbers, emails, SSNs and healthcare information including patient identifiers, medical records, diagnoses, medications, allergies and patient notes.
McKesson has not independently confirmed that scope or the alleged attack chain.
There is also a reported $55 million ransom demand, but McKesson has not publicly confirmed that figure either.
McKesson says it activated incident response procedures and brought in external cybersecurity specialists. It currently has reasonable assurance there is no continuing unauthorized activity, and its services, distribution centers, and customer connections remain operational.
If ShinyHunters’ account of initial access is eventually confirmed, this becomes another useful example of why protecting an SSO identity is only one part of the problem. Once a trusted identity is compromised, the downstream SaaS and data platforms accessible through it become part of the blast radius.
We kept the confirmed and claimed portions of this incident separate because the difference is substantial.
McKesson confirms unauthorized third-party application access and data exfiltration involving a subset of customers.
ShinyHunters is the source for the alleged vishing → Okta → Salesforce/Snowflake chain, 1 TB of stolen data, 284 million records, and the reported $55 million demand.
Our report also breaks down the healthcare information allegedly present and McKesson’s current operational status:
For defenders working with SaaS-heavy environments: where are you putting the strongest controls against vishing-driven SSO compromise: authentication, session monitoring, downstream application controls, or data-access anomaly detection?
Posted Sep 1, 2026, 4:33 PM UTC