---
title: "Data breach at McKesson Corporation"
description: "McKesson, a US pharmaceutical and medical distribution group, detected unauthorized access to third-party applications on August 25, 2026, affecting a subset of customers in its Oncology & Multispecialty and Medical-Surgical divisions. The ShinyHunters extortion group later published data it claims "
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-08-29-mckesson-corporation
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-08-29
dateModified: 2026-08-29
---
# McKesson Corporation

Data breach — Critical

McKesson, a US pharmaceutical and medical distribution group, detected unauthorized access to third-party applications on August 25, 2026, affecting a subset of customers in its Oncology & Multispecialty and Medical-Surgical divisions. The ShinyHunters extortion group later published data it claims came from this access; an independent analysis by Have I Been Pwned put the number of affected individuals at roughly 6.4 million, including patients, healthcare staff and business contacts. McKesson confirmed the incident and is offering affected individuals credit monitoring and identity theft protection.

The exposed data combines identity, contact and medical information, increasing exposure to targeted phishing attempts and identity theft.

| Fact | Value |
| --- | --- |
| Disclosed on | August 29, 2026 |
| Incident dated | August 25, 2026 |
| Accounts affected | 6.4M |
| Sector | Healthcare |
| Country | United States |
| Cause | Third-party provider |
| Severity | Critical |
| Status | Confirmed |

## Exposed data

- Email address
- Full name
- Phone number
- Postal address
- Date of birth
- Customer ID
- Social security number
- Health data

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
- Health data is “special category” data under the GDPR: a leak opens a right to compensation, and the organisation must notify the DPA within 72 hours.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [ShinyHunters expose 6.4M in attack on medical supplier McKesson](https://databreaches.net/2026/09/10/shinyhunters-expose-6-4m-in-attack-on-medical-supplier-mckesson/) — DataBreaches.net
- [ShinyHunters expose 6.4M in attack on medical supplier McKesson](https://www.theregister.com/security/2026/09/10/shinyhunters-expose-64m-in-attack-on-medical-supplier-mckesson/5295550) — The Register
- [McKesson discloses breach after ShinyHunters claims patient data theft](https://www.bleepingcomputer.com/news/security/mckesson-discloses-breach-after-shinyhunters-claims-patient-data-theft/) — BleepingComputer
- [Hackers claim millions of patient records stolen during data breach at healthcare giant McKesson](https://techcrunch.com/2026/08/31/hackers-claim-millions-of-patient-records-stolen-during-data-breach-at-healthcare-giant-mckesson/) — TechCrunch
- [McKesson confirms cyber incident after ShinyHunters claims patient-data theft](https://www.malwarebytes.com/blog/news/2026/08/mckesson-confirms-cyber-incident-after-shinyhunters-claims-patient-data-theft) — Malwarebytes
- [McKesson Confirms Data Breach as Attacker Deadline Looms](https://www.securityweek.com/mckesson-confirms-data-breach-as-attacker-deadline-looms/) — SecurityWeek
- [Notice of Data Breach](https://www.mckesson.com/utility/cybersecurity/notice-of-data-breach/) — McKesson

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-08-29-mckesson-corporation
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees