McKesson

Disclosed Aug 28, 20266,404,340 accountsConfirmed

McKesson discloses breach as ShinyHunters claims millions of patient records

McKesson disclosed unauthorized access to third-party cloud applications and said it continued operating with some degradation. ShinyHunters claimed millions of rows of patient data from Snowflake and Salesforce accounts obtained through social engineering and demanded $55 million.

What is known

People affected	6,404,340 (accounts in the leaked data, per Have I Been Pwned)
Disclosed	Aug 28, 2026
Discovered	Aug 2026
Happened	Aug 21, 2026
Attack	Phishing
Data exposed	Dates of birthEmailsEmploymentNamesHealthPhone numbersAddressesSocial Security numbers
Sector	Healthcare · US
Status	Confirmed
Check your email	Have I Been Pwned

Sources

Aggregatorhaveibeenpwned.com

Have I Been Pwned: McKesson

The organizationmckesson.com

McKesson disclosure

Newstechcrunch.com

Hackers claim millions of patient records stolen during data breach at healthcare giant McKesson

Newsbleepingcomputer.com

McKesson discloses breach after ShinyHunters claims patient data theft

Notices filed

TotalAug 28

ResearchCount not stated

Accounts in the dataSep 10

Have I Been Pwned6,404,340 people

Other breaches at McKesson

Breach, details not statedExposed names, Social Security numbers and names. Reported to the Maine AG.TechUSAug 9, 2013

History of this record

source_type2026-09-25

aggregator to officialby seedSource

source_url2026-09-25

https://haveibeenpwned.com/Breach/McKesson to https://www.mckesson.com/utility/cybersecurity/customer-cybersecurity-information-center/by seedSource

country2026-09-25

empty to USby seedSource

sector2026-09-25

tech to healthby seedSource

attack2026-09-25

third-party to phishingby seedSource

data_types2026-09-25

["dob","emails","employment","names","health","phone","addresses"] to ["dob","emails","employment","names","health","phone","addresses","ssn"]by seedSource

disclosed2026-09-25

2026-09-10 to 2026-08-28by seedSource

discovered2026-09-25

empty to 2026-08by seedSource

summary2026-09-25

In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign . The group subsequently published a substantial corpus of data they alleged was sourced from the company, which to McKesson disclosed unauthorized access to third-party cloud applications and said it continued operating with some degradation. ShinyHunters claimed millions of rows of patient data from Snowflake and Salesforce accounts obtained through soby seedSource

title2026-09-25

empty to McKesson discloses breach as ShinyHunters claims millions of patient recordsby seedSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Have I Been Pwned), confirmed by Company page. Record counts are as reported. Not legal advice.

Everything about McKesson