McKesson Data Breach (August 2026)

What Happened

McKesson disclosed the incident in a Form 8-K filed with the U.S. Securities and Exchange Commission on August 28, 2026, saying it discovered "a cybersecurity incident affecting its information systems" on August 25 and had not determined that the incident is material. According to The HIPAA Journal, McKesson announced the incident the same day, explaining that it had launched an investigation following "a cybersecurity incident involving third-party applications and unauthorized access and exfiltration of data."

In an August 29 update, McKesson said the exfiltrated data was associated with "a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units," SecurityWeek reported, along with the company's statements that the unauthorized access had been disrupted and that affected individuals would be offered complimentary credit monitoring and identity protection. A McKesson spokesperson told SecurityWeek the company has "reasonable assurance of no ongoing unauthorized activity" in its systems.

ShinyHunters told BleepingComputer that it gained access through voice phishing attacks on multiple McKesson employees, which compromised their Okta single sign-on accounts and let the group into the company's Salesforce and Snowflake environments, where it took about 1TB of data between August 21 and August 25. The group claims the Snowflake data holds approximately 284 million patient-related data records, a raw count of lines rather than of people, and that the stolen information includes names, addresses, dates of birth, Social Security numbers, Medicaid numbers, medical record numbers and medication and allergy information. BleepingComputer states that it has not independently verified these claims.

According to the Have I Been Pwned entry, the group went on to publish a substantial corpus of data it alleged came from McKesson, relating to marketing campaign recipients, patients, staff and healthcare provider contacts. Have I Been Pwned added 6,404,340 unique email addresses from that corpus on September 10, 2026 and flags the breach as sensitive, so it is not publicly searchable: people have to sign in to its dashboard to check their own address.

What Was Exposed

8 classes of data across 6,404,340 records, per Have I Been Pwned, McKesson breach entry: dates of birth, email addresses, employers, genders, names, personal health data, phone numbers and physical addresses.

Names, dates of birth, genders, addresses, phone numbers and email addresses sitting beside personal health data let a fraudster pose as a pharmacy, clinic or insurer that already knows a person's medical details, which makes a request for payment or insurance information far more believable.

What to Do If You Are Affected

The full sequence, and what to do in what order, is in what to do after a data breach.

What Is Not Known Yet

How the attackers got into the third-party applications, which types of data McKesson itself says were taken, and how many people it will notify. McKesson had not publicly confirmed the scale of the breach when The Register reported on the published data on September 10, 2026.