McKesson disclosed a data breach after the ShinyHunters extortion group claimed it stole roughly 284 million patient-related data records, including Social Security numbers, medical record numbers, and health details, from third-party systems tied to McKesson’s network in August 2026. The breach may affect patients, healthcare providers, and employees connected to McKesson. Affected individuals should monitor their credit reports and consider a credit freeze immediately.
| Company | McKesson |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Full Names, Home Addresses, Dates of Birth, Social Security Numbers, Patient ID Numbers, Medicaid Numbers, Medical Record Numbers, Medication and Health Information |
| People Affected | Not Publicly Disclosed |
| Attack Method | Voice Phishing/Unauthorized Access |
| Regulators Notified | Not Publicly Disclosed |
What Happened in the McKesson Data Breach?
McKesson, a major healthcare and pharmaceutical distribution company, has confirmed a cybersecurity incident involving unauthorized access to its systems. The McKesson data breach involved third-party applications connected to the company’s network. As a result, attackers were able to access and steal data from those systems.
According to McKesson, the company discovered the intrusion in August 2026. The investigation is still in its early stages, so many details remain unknown. However, the extortion group ShinyHunters has publicly claimed responsibility for the attack.
ShinyHunters told reporters it used voice phishing, also called vishing (voice phishing), to trick McKesson employees into giving up login credentials. The group claims it then compromised employee accounts tied to Okta, a single sign-on platform. From there, attackers allegedly moved into McKesson’s Salesforce and Snowflake cloud environments.
The threat actor claims it exfiltrated roughly one terabyte of data over four days in August 2026. ShinyHunters also claims the stolen data includes about 284 million individual data records. Importantly, this number reflects raw data entries, not necessarily unique patients affected.
McKesson has engaged outside cybersecurity experts to investigate the incident. The company activated its incident response plan as soon as it discovered the breach. In addition, McKesson warned customers that they may see occasional service disruptions connected to the attack. As of now, McKesson has not confirmed which systems were compromised or exactly what data was stolen.
Who was affected?
The full scope of individuals affected by the McKesson data breach has not been publicly disclosed. Because McKesson provides pharmaceutical distribution, medical supplies, and technology services to healthcare providers, the breach could reach a wide range of people. This may include patients whose health information passed through McKesson-connected systems, as well as healthcare providers and pharmacies that use its services.
ShinyHunters also claims the stolen data includes employee records and internal communications. Therefore, current or former McKesson employees could be impacted as well. Given the scale of McKesson’s operations across the United States, the breach likely has national reach.
Some of the claimed data reportedly involves deceased and terminally ill patients. This raises additional concerns for families managing the affairs of loved ones. Until McKesson issues formal notifications, affected individuals may not know for certain whether their information was involved.
What Information Was Potentially Exposed?
ShinyHunters has claimed responsibility for stealing a broad range of sensitive information from McKesson’s systems. While McKesson has not confirmed these specific details, the attackers described the categories of data taken during the intrusion.
- Full names
- Home addresses
- Dates of birth
- Social Security numbers
- Patient ID numbers
- Phone numbers and email addresses
- Medicaid numbers
- Medical record numbers
- Medication, allergy, and illness information
- Disability information
- Appointment and physician details
- Prescription and medication shipment records
If confirmed, this combination of data would be considered highly sensitive. Social Security numbers combined with dates of birth give criminals nearly everything needed to open new credit accounts. Because financial and medical identifiers may both be involved, affected individuals face risk on multiple fronts.
Medical record numbers and health details can also enable medical identity theft. This happens when someone uses stolen health information to receive treatment or file fraudulent insurance claims under another person’s name. As a result, victims sometimes find incorrect medical records attached to their own history, which can be difficult to correct later.
What is the company doing?
McKesson says it responded quickly once it discovered the incident. The company activated its incident response protocols and brought in outside cybersecurity experts. In addition, McKesson launched a formal investigation to determine what happened and how far the breach spread.
McKesson has also set up a dedicated cybersecurity information page for customers and posted updates as they become available. The company filed an official disclosure with the U.S. Securities and Exchange Commission, noting that it has not yet determined whether the incident is financially material. McKesson also filed formal notification with the U.S. Securities and Exchange Commission.
Going forward, McKesson says it will continue investigating to determine the full scope of the incident. The company has stated it will share more information as its understanding of the breach improves. Meanwhile, McKesson noted it has chosen not to proactively disconnect systems, though customers may experience intermittent service issues linked to the attack.
What Should Affected Individuals Do?
Monitor Your Credit Reports Closely
Because Social Security numbers may have been exposed, affected individuals should watch their credit reports carefully. Regularly checking your credit report can help you catch new accounts or inquiries you did not authorize. You are entitled to a free credit report from each major bureau every year.
In addition, consider spacing out your requests so you can review your credit throughout the year. If you notice unfamiliar accounts or hard inquiries, report them immediately. Early detection often makes fraud much easier to resolve before it grows.
Consider a Fraud Alert or Credit Freeze
Given the potential exposure of Social Security numbers, a credit freeze offers strong protection. A freeze blocks lenders from accessing your credit file, which makes it much harder for criminals to open accounts in your name. You can place a freeze for free with each of the three major credit bureaus.
Alternatively, a fraud alert warns creditors to verify your identity before extending credit. This option is faster to set up and still adds a meaningful layer of protection. Because both freezes and alerts are free, there is little downside to using either one.
Stay Alert for Phishing and Vishing Attempts
Since this breach reportedly began with a vishing, or voice phishing, attack, individuals should be especially cautious about unexpected phone calls. Scammers may use stolen personal details to sound convincing when posing as McKesson, a healthcare provider, or a government agency. Never provide login credentials, verification codes, or personal information to unsolicited callers.
Instead, hang up and contact the organization directly using a verified phone number. This simple step can prevent attackers from tricking you the same way McKesson employees were reportedly targeted. Similarly, be cautious of unexpected emails or texts asking you to click links or confirm account details.
Protect Against Medical Identity Theft
Because medical record numbers and health information may be involved, it’s wise to review any insurance statements you receive. Look closely at Explanation of Benefits documents for unfamiliar treatments, providers, or prescriptions. This can be an early sign of medical identity theft.
If you spot suspicious activity, contact your insurance provider and healthcare providers right away. You may also request a copy of your medical records to check for inaccurate entries. Correcting these errors quickly can prevent complications with future medical care or insurance claims.
Know Your Legal Options
If you believe your information was exposed in the McKesson data breach, you may have legal options available. Many data breach victims choose to consult with a data breach attorney to understand potential compensation. An attorney can review your specific situation and explain whether you qualify to join a claim.
Because these cases often involve strict filing deadlines, it helps to act sooner rather than later. A free case evaluation can clarify your rights without any upfront cost. This allows you to make an informed decision about pursuing legal action.