McKesson Discloses Data Breach as ShinyHunters Demands $55M Over Stolen Records

Healthcare distribution giant McKesson disclosed an unauthorized cybersecurity incident involving third-party application compromise and data exfiltration after discovering the breach on August 25, 2026. The ShinyHunters extortion group demanded a $55,236,150 ransom with a 72-hour deadline, alleging it exfiltrated approximately 1TB of data between August 21 and August 25. The stolen records reportedly contain approximately 284 million lines of patient-related data from Snowflake alongside compromised Salesforce support case environments. ShinyHunters gained initial network entry through voice phishing attacks against employees using the spoofed domain mckesson[.]claims to compromise Okta single sign-on credentials. "As of the date of this filing, the company has not determined that the incident is material or that the incident has had, or is reasonably likely to have, any material impact on the company, including its financial condition or results of operations." — McKesson SEC Form 8-K Filing