McKesson Data Breach: Unauthorized Access to Third-Party Applications and Data Taken

Part 8 of 8 in Recent Cyberattacks: Fall 2026 Briefings

McKesson, one of the largest U.S. healthcare distributors, discovered a cybersecurity incident on August 25, 2026 and disclosed it in an SEC filing three days later (McKesson 8-K). A McKesson executive later confirmed unauthorized access to certain third-party applications and the exfiltration of certain data, affecting a subset of customers in two business units (Malwarebytes). An extortion group has made larger claims that McKesson has not confirmed (BleepingComputer). The case is a lesson in how much sensitive data now sits in cloud applications reached through single sign-on.

Each item is linked to its source. Verification status reflects the strongest source available on the verification date.

What happened

1. Aug 25. McKesson discovers the incident (McKesson 8-K).
2. Aug 28. 8-K filed; McKesson says the investigation is in its early stages and it has not determined the incident is material (McKesson 8-K). BleepingComputer reports the ShinyHunters claims the same day (BleepingComputer).
3. By Aug 31. McKesson’s chief information and technology officer confirms third-party application access and data exfiltration (Malwarebytes).
4. By Sept 2. McKesson says businesses and distribution are operating and it has reasonable assurance the activity has stopped (Healthcare Dive).
5. Sept 18. HIPAA Journal reports that the number of affected individuals had not yet been determined (HIPAA Journal).

Attacker claims, clearly labeled

The extortion group ShinyHunters claims it reached McKesson data by voice-phishing employees, taking over their single sign-on accounts and then accessing cloud applications, and it posted a ransom demand. BleepingComputer says it has not independently verified these claims (BleepingComputer). McKesson has not named the applications involved or confirmed the method. Figures the group published count rows of data, not individual patients (BleepingComputer; HIPAA Journal).

The claimed method matches the help-desk impersonation pattern Microsoft documented in a separate report the following month (Microsoft Threat Intelligence, Sept 9, 2026); that is a pattern match, not a finding about McKesson.

What is still unknown

How organizations can reduce SaaS and single sign-on risk

General controls for any organization whose data lives in cloud applications reached through SSO:

1. List every cloud application connected to your SSO and what data each one holds.
2. Use phishing-resistant MFA for SSO and require managed devices for applications with sensitive data (Microsoft Threat Intelligence, Sept 9, 2026).
3. Limit bulk export: alert on large downloads or report exports from CRM, data-warehouse and file-sharing apps.
4. Train help-desk and support staff to verify callers before resetting passwords or MFA (Microsoft Threat Intelligence, Sept 9, 2026).
5. Review vendor and integration permissions at least quarterly and remove unused connections.

More in this series

See all briefings and their verification status in the recent cyberattacks and data breaches tracker.

Sources

1. McKesson, SEC Form 8-K, August 28, 2026. https://www.sec.gov/Archives/edgar/data/0000927653/000092765326000247/mck-20260825.htm
2. BleepingComputer, August 28, 2026. https://www.bleepingcomputer.com/news/security/mckesson-discloses-breach-after-shinyhunters-claims-patient-data-theft/
3. Malwarebytes, August 31, 2026. https://www.malwarebytes.com/blog/news/2026/08/mckesson-confirms-cyber-incident-after-shinyhunters-claims-patient-data-theft
4. Healthcare Dive, September 2, 2026. https://healthcaredive.com/news/mckesson-confirms-data-theft-cyberattack-involving-third-party-apps/829435
5. HIPAA Journal, September 18, 2026. https://hipaajournal.com/mckesson-data-breach
6. Microsoft Security Blog, September 9, 2026. https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/