McKesson Corporation
CriticalConfirmedHealthcare
McKesson, a US pharmaceutical and medical distribution group, detected unauthorized access to third-party applications on August 25, 2026, affecting a subset of customers in its Oncology & Multispecialty and Medical-Surgical divisions. The ShinyHunters extortion group later published data it claims came from this access; an independent analysis by Have I Been Pwned put the number of affected individuals at roughly 6.4 million, including patients, healthcare staff and business contacts. McKesson confirmed the incident and is offering affected individuals credit monitoring and identity theft protection.
The exposed data combines identity, contact and medical information, increasing exposure to targeted phishing attempts and identity theft.
- Disclosed on
- August 29, 2026
- Incident dated
- August 25, 2026
- Accounts affected
- 6.4M
- Sector
- Healthcare
- Country
- United States
- Cause
- Third-party provider
Exposed data
- Email address
- Full name
- Phone number
- Postal address
- Date of birth
- Customer ID
- Social security number
- Health data
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
- Health data is “special category” data under the GDPR: a leak opens a right to compensation, and the organisation must notify the DPA within 72 hours.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
- ShinyHunters expose 6.4M in attack on medical supplier McKessonDataBreaches.net
- ShinyHunters expose 6.4M in attack on medical supplier McKessonThe Register
- McKesson discloses breach after ShinyHunters claims patient data theftBleepingComputer
- Hackers claim millions of patient records stolen during data breach at healthcare giant McKessonTechCrunch
- McKesson confirms cyber incident after ShinyHunters claims patient-data theftMalwarebytes
- McKesson Confirms Data Breach as Attacker Deadline LoomsSecurityWeek
- Notice of Data BreachMcKesson
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact