McKesson
Disclosed Aug 28, 20264 weeks ago6,404,340 accountsConfirmed
McKesson discloses breach as ShinyHunters claims millions of patient records
McKesson disclosed unauthorized access to third-party cloud applications and said it continued operating with some degradation. ShinyHunters claimed millions of rows of patient data from Snowflake and Salesforce accounts obtained through social engineering and demanded $55 million.
What is known
| People affected | 6,404,340 (accounts in the leaked data, per Have I Been Pwned) |
|---|---|
| Disclosed | Aug 28, 2026 |
| Discovered | Aug 2026 |
| Happened | Aug 21, 2026 |
| Attack | Phishing |
| Data exposed | Dates of birth, Emails, Employment, Names, Health, Phone numbers, Addresses, Social Security numbers |
| Sector | Healthcare · US |
| Status | Confirmed |
| Check your email | Have I Been Pwned |
Sources
| Source | |
|---|---|
| Have I Been Pwned: McKessonhaveibeenpwned.com · Aggregator | Aggregator |
| McKesson disclosuremckesson.com · The organization | The organization |
| Hackers claim millions of patient records stolen during data breach at healthcare giant McKessontechcrunch.com · News | News |
| McKesson discloses breach after ShinyHunters claims patient data theftbleepingcomputer.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Aug 28 | |
| Have I Been Pwnedaccounts in the data | Sep 10 | 6,404,340 |
Other breaches at McKesson
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Aug 9, 2013Aug 9, 201313 years ago | Aug 9, 201313 years ago | Not stated | Tech | Confirmed | Unknown |
History of this record
- 2026-09-25 · source_type: aggregator to official · seed source
- 2026-09-25 · source_url: https://haveibeenpwned.com/Breach/McKesson to https://www.mckesson.com/utility/cybersecurity/customer-cybersecurity-information-center/ · seed source
- 2026-09-25 · country: empty to US · seed source
- 2026-09-25 · sector: tech to health · seed source
- 2026-09-25 · attack: third-party to phishing · seed source
- 2026-09-25 · data_types: ["dob","emails","employment","names","health","phone","addresses"] to ["dob","emails","employment","names","health","phone","addresses","ssn"] · seed source
- 2026-09-25 · disclosed: 2026-09-10 to 2026-08-28 · seed source
- 2026-09-25 · discovered: empty to 2026-08 · seed source
- 2026-09-25 · summary: In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign . The group subsequently published a substantial corpus of data they alleged was sourced from the company, which to McKesson disclosed unauthorized access to third-party cloud applications and said it continued operating with some degradation. ShinyHunters claimed millions of rows of patient data from Snowflake and Salesforce accounts obtained through so · seed source
- 2026-09-25 · title: empty to McKesson discloses breach as ShinyHunters claims millions of patient records · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Have I Been Pwned), confirmed by Company page. Record counts are as reported. Not legal advice.