McKesson Cybersecurity Breach Involves 284 Million Patient Records

• •ShinyHunters claims to have stolen 284 million patient records from McKesson.
• •The breach was initiated through voice phishing attacks on McKesson employees.
• •Customers may face service degradation while McKesson investigates the incident.

McKesson, a major healthcare and pharmaceutical distributor, disclosed a cybersecurity incident involving unauthorized access to third-party applications and the theft of 284 million patient data records. The ShinyHunters extortion group claimed responsibility, stating they accessed the data through voice phishing (vishing) attacks targeting McKesson employees. The breach was discovered on August 25, 2026, and McKesson reported it in a Form 8-K filing with the SEC. The company has activated incident response protocols and is investigating the full scope of the incident. Customers may experience intermittent service degradation as a result of the attack. McKesson has not yet disclosed which third-party applications were compromised or the specific data that was stolen. The investigation is ongoing, and updates will be provided as more information becomes available.