McKesson, one of the largest pharmaceutical distributors in the world, discovered a breach on 25 August 2026 and disclosed it three days later. Its statement is that the incident involved third-party applications and the unauthorised access and exfiltration of data.
It has not said which applications, or what data.
ShinyHunters has said a great deal more, and the most useful thing the group has said is a correction.
The number, and what it actually counts
The claim is roughly 1 terabyte and about 284 million records, taken between 21 and 25 August.
Every headline will render that as 284 million patients. ShinyHunters has clarified that the figure counts records or lines, not unique individuals.
That is not a quibble. A single patient generates a row for each prescription, each appointment, each allergy, each physician association. One person with a chronic condition can account for dozens of records across a decade. Nobody currently knows how many people are in that data — including the group that took it.
When the party with every incentive to inflate a number volunteers that the number means less than it appears to, the rest of us have no excuse for reporting it the other way.
What is claimed to be in it
Per ShinyHunters: names, addresses, dates of birth, Social Security numbers, patient IDs, phone numbers, email addresses, Medicaid numbers, medical record numbers, medication and allergy information, illnesses, disabilities, appointment information and physician information.
If accurate, that is the most sensitive combination available — identity documents plus clinical history. Social Security numbers do not rotate. A medication list is a diagnosis by inference.
McKesson has not confirmed any of it. BleepingComputer has not independently verified the claims, and the company has not disclosed what was taken.
The route in, as claimed
ShinyHunters says the compromise involved Okta single sign-on accounts, which gave access to Salesforce and Snowflake environments.
That is the same shape as the ReliaQuest incident earlier this week, where the same group phoned employees, took one identity and reached an Okta dashboard — except there, authorisation held and the attackers were denied at every application.
Here, on the group's account, it did not. One identity provider, two data platforms behind it, and the thing that decides the outcome is what sits between them.
The ransom figure is a technique
$55.236 million, within 72 hours.
Nobody arrives at that by valuing anything. A precise-looking figure implies a calculation has been done, which implies the demand is considered rather than arbitrary, which makes it feel negotiable in a way that fifty million does not. The deadline does the rest.
It is worth naming because the same reflex applies to the volume claims. Precision reads as credibility, and here the precision is decoration.
The pattern this week
Three incidents, three different relationships between claim and evidence:
| Case | Claim | Evidence |
|---|---|---|
| McKesson | Detailed, from the attacker | Company confirms a breach, not the contents |
| Berlin | Detailed, from the attacker | Government publishes no figures at all |
| Boston Scientific | None — nobody claimed it | Company confirms serious disruption |
In two of the three, the only numbers in public come from the people who benefit from the numbers being large.
What to do if you are a patient
Realistically, nothing yet — and be wary of anyone who tells you otherwise this week.
- Do not act on emails about this breach. Notification fraud follows disclosure faster than actual notification does.
- A credit freeze is the one useful step if Social Security numbers were genuinely involved, and it is free.
- Wait for McKesson's own notification for the scope. The attacker's inventory is not it.
What is not established
- How many people are affected. Not known to anyone, including ShinyHunters.
- Which third-party applications were involved. McKesson has not said.
- What data was actually taken, as opposed to claimed.
- Whether the Okta, Salesforce and Snowflake account is accurate.
- Whether McKesson will pay. No public statement.
