ShinyHunters claims it stole 284 million patient records from McKesson

McKesson disclosed an intrusion detected on August 25, 2026, involving unauthorized access to certain third‑party applications and exfiltration of customer and employee data tied to Oncology & Multispecialty and Medical‑Surgical units; the company is investigating with outside cybersecurity experts. The extortion group ShinyHunters claims it gained access via vishing to obtain credentials, compromised Okta single‑sign‑on accounts, moved into Salesforce and Snowflake, and extracted about 1 TB (allegedly 284 million rows) of sensitive records before demanding $55,236,150; those claims remain unverified and McKesson says no customer action is currently required.