Loading story…
Healthcare and pharmaceutical distributor McKesson disclosed that unauthorized actors accessed certain third-party applications and exfiltrated data affecting a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units. The incident was linked to a purported ShinyHunters “pay or leak” extortion campaign, in which the group allegedly published data after McKesson did not pay.
The published dataset reportedly contains 6.4 million unique email addresses alongside personal and corporate information involving marketing recipients, patients, employees, and healthcare-provider contacts. McKesson said it had reasonable assurance that unauthorized activity was no longer ongoing, while affected organizations should assess potential phishing, credential-stuffing, and impersonation risk arising from the exposed contact data.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
In August 2026, ShinyHunters targeted healthcare and pharmaceutical company McKesson in a purported pay-or-leak extortion campaign. McKesson later identified unauthorized access to certain third-party applications and data exfiltration affecting subsets of customers in its Oncology & Multispecialty and Medical-Surgical units.
Have I Been Pwned added data allegedly leaked from the McKesson incident, providing the first reported estimate that roughly 6.4 million individuals were affected. ShinyHunters also claimed it stole 284 million documents, a claim not independently verified by McKesson.
ShinyHunters allegedly published a dataset claimed to have been taken from McKesson after the company reportedly did not pay. The dataset reportedly included 6.4 million unique email addresses and personal and corporate data relating to marketing recipients, patients, staff, and healthcare-provider contacts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcehaveibeenpwned.com
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
McKesson disclosed a cybersecurity incident discovered on August 25 involving unauthorized access to third-party applications and data exfiltration. The healthcare company and pharmaceutical distributor is investigating the scope of the intrusion, including the affected systems and information, and said in an SEC filing that it had not determined the incident to be material. The ShinyHunters extortion group claimed it used voice-phishing attacks to compromise employees’ Okta single sign-on accounts, then accessed Salesforce and Snowflake environments over four days. The group alleges it stole about 1 TB of data, representing 284 million records, and demanded a $55.24 million ransom; McKesson has not verified the claimed attack path, data volume, record count, patient impact, or data types involved.
Sep 1, 2026
AdaptHealth confirmed that a cyberattack exposed the personal and health information of **4,115,802 individuals**. The intrusion began on June 5, 2026, after attackers allegedly used social engineering to compromise a privileged account belonging to a third-party provider, gaining access to cloud applications, patient-management systems, document storage, and electronic health-record portals. Exposed data includes identity and contact details, demographic information, health-insurance information, and protected health information. An unidentified actor issued a ransom demand on June 15; ShinyHunters is suspected because AdaptHealth briefly appeared on the group’s extortion portal, though the company has not formally attributed the incident to the group.
Sep 11, 2026
McGraw Hill confirmed that attackers accessed a limited set of internal data through a misconfigured Salesforce-hosted webpage, after the **ShinyHunters** extortion group claimed responsibility and threatened to publish stolen information unless a ransom was paid. The company said the incident was tied to a broader issue affecting multiple organizations using Salesforce-hosted environments and maintained that its Salesforce accounts, customer databases, courseware, internal systems, Social Security numbers, financial account information, and student data from its educational platforms were not impacted. After the extortion deadline passed, data tied to **13.5 million** McGraw Hill user accounts was reportedly leaked publicly, with **Have I Been Pwned** saying the dump contained more than **100GB** of files, including unique email addresses and some names, physical addresses, and phone numbers. The leak contradicted earlier company statements that the exposed data was limited and non-sensitive, while ShinyHunters separately claimed to hold **45 million** Salesforce records; McGraw Hill said it secured the affected webpages, brought in external cybersecurity experts, and is working with Salesforce to strengthen protections.
Jun 29, 2026