Loading story…
McKesson disclosed a cybersecurity incident discovered on August 25 involving unauthorized access to third-party applications and data exfiltration. The healthcare company and pharmaceutical distributor is investigating the scope of the intrusion, including the affected systems and information, and said in an SEC filing that it had not determined the incident to be material.
The ShinyHunters extortion group claimed it used voice-phishing attacks to compromise employees’ Okta single sign-on accounts, then accessed Salesforce and Snowflake environments over four days. The group alleges it stole about 1 TB of data, representing 284 million records, and demanded a $55.24 million ransom; McKesson has not verified the claimed attack path, data volume, record count, patient impact, or data types involved.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
McKesson discovered a cybersecurity incident involving unauthorized access to third-party applications and data exfiltration. The company began an investigation, activated incident-response procedures, and engaged external cybersecurity experts.
ShinyHunters claimed it used voice-phishing to compromise McKesson employees' Okta SSO accounts, access Salesforce and Snowflake environments, and exfiltrate about 1 TB of data between August 21 and August 25. The group alleged the Snowflake data contained roughly 284 million records, but McKesson did not confirm the attack path, data types, volume, or affected applications.
McKesson confirmed that attackers exfiltrated customer data affecting a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units. The company said it disrupted the unauthorized access, services remained operational, and impacted individuals would receive complimentary credit-monitoring and identity-protection services.
The domain mckesson[.]claims was identified as allegedly used in the campaign against McKesson. The source noted that its .claims naming pattern has previously been associated with ShinyHunters activity.
ShinyHunters claimed responsibility for the McKesson intrusion and alleged it demanded a $55,236,150 ransom with a 72-hour response deadline. The group claimed McKesson did not respond or negotiate; these claims were not independently verified.
McKesson disclosed the incident in a Form 8-K, stating that its investigation was in early stages and that it had not determined the event to be material or likely to have a material financial or operational impact. It warned customers of possible intermittent service degradation and said it was not proactively disconnecting systems.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
9 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcetherecord.media
Open sourcehelpnetsecurity.com
Open sourcethecyberthrone.in
Open sourcecysecurity.news
Open sourcemalware.news
Open sourcebleepingcomputer.com
Open sourcemckesson.com
Open sourcesec.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AdaptHealth disclosed a material cybersecurity incident after attackers used social engineering against a third-party contractor, compromised the contractor’s credentials, and accessed the company’s cloud-based business applications. The intrusion exposed internal patient management systems, document storage platforms, external electronic health record portals, and a stored password file tied to insurance billing, with patient personally identifiable information and protected health information believed to have been stolen. The company said the attacker contacted it on June 15 to disclose the theft, and it later determined the breach was material enough to report to the SEC. AdaptHealth said it disabled the contractor account, reset credentials, added access controls, engaged third-party cybersecurity experts, and notified law enforcement while the investigation continues. The company reported that operations and patient services were not disrupted, the total number of affected individuals is still unknown, and Social Security numbers, financial account information, and payment card data are not believed to have been stored in the compromised systems. Reporting also indicated the activity may be consistent with a data-theft-and-extortion attempt linked to **ShinyHunters**, which allegedly listed AdaptHealth on a leak site and threatened to publish the stolen data if no ransom is paid.
Jul 6, 2026
Brinks Home disclosed that attackers gained unauthorized access to part of its IT environment and are threatening to leak allegedly stolen data, while extortion group **ShinyHunters** has claimed responsibility for the intrusion. The company said it detected the incident on July 20 and immediately began incident response, adding that its alarm monitoring operations, products, and core system functionality were not affected based on current findings. ShinyHunters alleges it accessed Brinks Home on July 13 through a Microsoft Entra voice-phishing attack and exfiltrated more than **4.9 million** Salesforce records, including some employee personally identifiable information, customer support chat logs, and other data from the company’s Salesforce environment. Brinks Home said it is still determining exactly what information was involved and which individuals may be affected, and warned customers that threat actors may use the incident to send fraudulent messages impersonating Brinks Home or its response partners.
Aug 10, 2026
Health-ISAC warned that **ShinyHunters** is increasingly targeting healthcare and medical technology organizations through identity-focused social engineering, especially voice phishing, to seize control of single sign-on environments and connected SaaS platforms. Reported attack chains involve manipulating helpdesk staff or employees into resetting passwords, changing MFA methods, or enrolling attacker-controlled devices, followed by compromise of **Microsoft Entra**, **Okta**, or **Google SSO** accounts and rapid access to services such as **Microsoft 365**, **SharePoint**, and **Salesforce** for large-scale data exfiltration. The group is being tracked more as an **extortion-by-data-theft** actor than a traditional ransomware operator, with recent incident reporting citing theft from enterprise cloud environments after SSO compromise. Separate reporting also identified **RingCentral** as a claimed victim, with attackers alleging stolen data and threatening to leak it unless contacted, underscoring the group’s broader pattern of using compromised identity infrastructure and SaaS access to pressure victims. Health-ISAC urged organizations to treat SSO as a critical control plane, harden helpdesk and MFA reset workflows, deploy phishing-resistant MFA and conditional access, centralize identity and SaaS logging, and prepare cloud-focused containment playbooks.
Aug 4, 2026