INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

ShinyHunters claims patient data theft at McKesson cybersecurity incident

| 2026-08-29 01:02 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
McKesson, a major U.S. healthcare company and pharmaceutical distributor, is investigating a cybersecurity incident involving unauthorized access to third-party applications and data theft by the ShinyHunters extortion group, which claims it stole 284 million patient data records. The breach occurred in early stages of investigation on August 28, with McKesson stating that no action was required by customers at this time. If technical issues arise, customers are advised to contact support channels. ShinyHunters issued a "Final Warning" to respond by September 1, but provided no proof for its claims. The incident is categorized as extortion and exfiltration of data, targeting the healthcare, pharmaceutical, technology sectors in the United States.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters
Target & Sectors
NORTH_AMERICA NORTH_AMERICA healthhealth pharmaceuticalpharmaceutical
Incident Timeline
‎2026/08/29
ShinyHunters claims to have stolen 284 million patient data records from McKesson, a pharmaceutical distribution giant.
threat_actor ShinyHunters
…pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming it stole 284 million patient data records.
McKesson is investigating a cybersecurity incident after ShinyHunters claims patient data theft.
Their notice does not name ShinyHunters or what specific third-party applications they are referring to.
For its part, ShinyHunters provides no proof of its claims to support its statement about hundreds of millions of records/rows, but issues a “Final Warning” to respond by September 1.
In the past, ShinyHunters’ claims have sometimes proven to have highly exaggerated numbers.
data_breach 284 patient data records
Lawrence Abrams reports: Healthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming it…
Tactical Metrics
Metrics
data_breach
284,000,000
Patient Data Records
Lawrence Abrams reports: Healthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming it…
Intelligence Sources
Data Breaches 2026-08-29