---
title: McKesson Confirms Breach as ShinyHunters Claims 284 Million Records
description: McKesson hit by cyberattack, ShinyHunters claims data theft and demands $55M ransom. Discover how this impacts their operations and the healthcare sector.
canonical_url: https://codekeeper.co/ticker/mckesson-cyberattack-shinyhunters-data-breach
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

# McKesson Confirms Breach as ShinyHunters Claims 284 Million Records

McKesson hit by cyberattack, ShinyHunters claims data theft and demands $55M ransom. Discover how this impacts their operations and the healthcare sector.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Sep 7, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmckesson-cyberattack-shinyhunters-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmckesson-cyberattack-shinyhunters-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmckesson-cyberattack-shinyhunters-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmckesson-cyberattack-shinyhunters-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmckesson-cyberattack-shinyhunters-data-breach%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmckesson-cyberattack-shinyhunters-data-breach%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

McKesson, one of North America's largest pharmaceutical distributors with $403.4 billion in annual revenue, disclosed a cyberattack on August 28, 2026, three days after discovering it. Unauthorized access to certain third-party applications led to data theft affecting a subset of customers within its Oncology & Multispecialty and Medical-Surgical business units, the company says. ShinyHunters claimed responsibility, though McKesson has not named the group. It says it used voice phishing to compromise employees' Okta single sign-on accounts, then reached the Salesforce and Snowflake environments and exfiltrated data between August 21 and August 25, claiming roughly 284 million records and demanding over $55 million. That figure counts database rows rather than patients, and the group has not fully analyzed the data. None of its claims are independently verified. A September 1 deadline to open negotiations passed without a response from the company, which has declined to comment on the demand. Its distribution centers remain operational, McKesson says, though it warned customers to expect intermittent service degradation. Health-ISAC had warned the healthcare sector about ShinyHunters just weeks before the breach. Source: [CyberScoop](https://cyberscoop.com/mckesson-data-theft-extortion-attack-shinyhunters/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmckesson-cyberattack-shinyhunters-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmckesson-cyberattack-shinyhunters-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmckesson-cyberattack-shinyhunters-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmckesson-cyberattack-shinyhunters-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmckesson-cyberattack-shinyhunters-data-breach%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmckesson-cyberattack-shinyhunters-data-breach%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks New Citrix NetScaler Zero-Day Hits Already-Patched Systems Oct 7, 2026](https://codekeeper.co/ticker/citrix-netscaler-zero-day-exploit-cve-2026-88779)

[OpenAI's Rogue AI Hacked Multiple Services, Not Just Hugging Face Aug 11, 2026](https://codekeeper.co/ticker/rogue-ai-hacks-hugging-face-and-more)

[Cyberattacks AI-Powered Attack Hits Dutch Cybersecurity Organization Using Zammad Zero-Days Oct 2, 2026](https://codekeeper.co/ticker/divd-hacked-ai-powered-attack-zammad-zero-days)

[Software security Apple Patches Actively Exploited Zero-Day in CoreGraphics Sep 29, 2026](https://codekeeper.co/ticker/apple-emergency-updates-fix-zero-day-flaw)