McKesson breach: ShinyHunters demands $55M ransom, shares stolen patient data samples

Hackers accessed cloud-hosted Snowflake and Salesforce environments, stealing millions of patient records

edit

By LineZotpaper

Published29 August 2026

Updated1 September 2026

Read Time2 min

Sources2 outlets

The ShinyHunters extortion group has demanded a $55 million ransom from healthcare giant McKesson after claiming to steal millions of patient records, and has shared data samples with journalists, as the company confirms it is investigating the breach.

The ShinyHunters hacking group has provided TechCrunch with screenshots and a sample of data stolen from McKesson, which TechCrunch verified a small subset of against public records. The hackers claim to have stolen names, addresses, Social Security numbers, and protected health information including diagnoses, medications, allergies, and patient notes from the company's cloud-hosted Snowflake and Salesforce environments. They said they are unsure how many individuals are ultimately affected.

BleepingComputer reported that ShinyHunters demanded a $55 million ransom from the company in exchange for not publicly releasing the stolen files. McKesson spokesperson Kristina Chang said the company “continues to operate in all lines of business,” reiterated its public statement, and noted that McKesson believes it has no ongoing unauthorized activity in its systems. The company would not answer questions about the ransom demand or the number of affected individuals.

In a separate notice to customers, McKesson’s chief technology officer, Francisco Fraga, said the stolen data relates to its oncology & multispecialty and medical-surgical units.

McKesson first disclosed the incident on August 25 in a Form 8-K filing with the SEC, stating the investigation is in early stages and that it had not determined the incident to be material. The company said it immediately activated incident response protocols and engaged cybersecurity experts.

The ShinyHunters group told BleepingComputer it gained access through voice phishing (vishing) social engineering attacks against multiple McKesson employees, using the domain mckesson[.]claims as part of the campaign. McKesson warned customers that intermittent service degradation may occur, though it is not proactively disconnecting systems.

McKesson is the latest in a string of cyberattacks targeting healthcare companies, following recent incidents at Boston Scientific and Stryker.

Analysis

Why This Matters

The breach may expose millions of patients to identity theft and medical fraud, given the theft of Social Security numbers and detailed health information.
Healthcare companies continue to be a prime target for extortion, as sensitive medical data is highly valuable on the black market and disruptive to operations.
McKesson's assessment that the incident is not material could face scrutiny if the full scope of affected individuals is larger than initially believed.

Background

McKesson is a major U.S. pharmaceutical distributor and healthcare services company, handling a vast amount of patient data. The ShinyHunters group is one of the most active data-extortion crews, known for social engineering and cloud environment breaches. In recent months, similar attacks have hit medical device makers Boston Scientific and Stryker, highlighting a pattern of targeting the healthcare sector.

Key Perspectives

McKesson: The company says its investigation is ongoing, has not determined the incident to be material, and believes no ongoing unauthorized activity exists. It prioritizes partner and patient privacy and is cooperating with cybersecurity experts. ShinyHunters: The group claims to have stolen millions of patient records and demands $55 million. It provided data samples to journalists as proof, indicating a willingness to leak the data if the ransom is not paid. Critics/Skeptics: The scale of the alleged breach (284 million records claimed by ShinyHunters) raises questions about McKesson's security posture and whether the company's statement of non-materiality will hold. Regulators and patient advocacy groups are likely to push for more transparency.

What to Watch

Whether McKesson decides to pay the ransom or negotiate with ShinyHunters.
The number of individuals affected once McKesson completes its investigation.
Potential regulatory actions from the SEC, HHS (HIPAA violations), and state attorneys general, especially if the data is publicly leaked.

Sources

McKesson discloses breach after ShinyHunters claims patient data theft — BleepingComputer
Hackers claim millions of patient records stolen during data breach at healthcare giant McKesson — TechCrunch