ShinyHunters Extortion Campaign Exposes 6.4 Million McKesson Email Addresses

Healthcare and pharmaceutical distributor McKesson disclosed that unauthorized actors accessed certain third-party applications and exfiltrated data affecting a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units. The incident was linked to a purported ShinyHunters “pay or leak” extortion campaign, in which the group allegedly published data after McKesson did not pay.

The published dataset reportedly contains 6.4 million unique email addresses alongside personal and corporate information involving marketing recipients, patients, employees, and healthcare-provider contacts. McKesson said it had reasonable assurance that unauthorized activity was no longer ongoing, while affected organizations should assess potential phishing, credential-stuffing, and impersonation risk arising from the exposed contact data.