McKesson data breach (August 2026): what McKesson disclosed
In August 2026 McKesson, the largest US drug distributor by revenue, disclosed a cybersecurity incident; ShinyHunters then claimed a very large data theft.
Short answer
Was McKesson hacked?
McKesson confirmed a cybersecurity incident. Its Form 8-K (Item 7.01) says it discovered the incident on 25 August 2026 and has not determined that it is material.
ShinyHunters claims about 284 million records and a $55.2 million demand, via vished Okta accounts and Salesforce and Snowflake. McKesson has not confirmed scope, data or attacker.
28 Aug 20268-K filed under Item 7.01; materiality not determined. (Fierce Healthcare)Confirmed
Aug 2026ShinyHunters claims 284M records and $55.2M demand. (Fierce Healthcare)Unverified claim
Last updated October 31, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
McKesson’s security posture at the time
What McKesson publicly said about its security certifications and controls, how big it is, and how its shares moved, each tied to a source. A certificate covers a stated scope at a point in time; it is not a guarantee about every system. Reviewed 31 October 2026. Compare all 2026 breaches.
Security certifications publicly held
No public certification found.
No public certification found on the company’s own security, trust or compliance pages, in filings, or in the certificate registries searched (BSI, CSA STAR). That is a data point, not proof that none exists.
Publicly known security controls and platforms
Okta, Salesforce and Snowflake: ShinyHunters says it vished employees, used compromised Okta SSO accounts and reached Salesforce and Snowflake. McKesson has not confirmed which applications were affected. (attacker claim; Fierce Healthcare — McKesson confirms incident)
No reliable report of a share-price move around the disclosure was found.
McKesson incident timeline, in detail
Confirmed = acknowledged by McKesson, a regulator filing or a court. Reported = credible reporting McKesson has not fully confirmed. Unverified claim = an attacker or leak-site claim.
28 Aug 2026 (found 25 Aug)ConfirmedIdentity / SaaS (claimed)
Incident disclosed; ShinyHunters claims a massive data theft
What happened. McKesson’s Form 8-K (Item 7.01) says it discovered a cybersecurity incident on 25 August 2026 and has not determined that it is material. ShinyHunters claims about 284 million records and a $55.2 million demand; McKesson has not confirmed scope, data or attacker.
Impact. Customers may see intermittent service degradation, per McKesson. People or records affected: Not disclosed. ShinyHunters claims 284 million records, which it later described as a raw row count (unverified).
ShinyHunters later described the 284 million figure as a raw row count, not unique people.
The pattern across the record
Certified, and still breached?
We found no SOC 2 or ISO 27001 certification published by McKesson. That does not prove it had none; it means none was public.
The way in was a person, not a server
Like most of 2026’s large data thefts, this one is described as starting with social engineering: a phished or voice-phished login, often to single sign-on, then bulk export from a SaaS application. Certification audits test that identity controls exist and operate; they do not promise that no employee or contractor will ever be talked out of a login.
What it means for McKesson pharmacies, providers and manufacturers that use McKesson — and what to do
What McKesson’s customers, partners and security teams can do now, based only on what has been disclosed.
1.Assume phishing follows the breach
Exposed contact details are used for convincing follow-up phishing. Warn staff and customers that genuine notices will not ask for passwords or payment.
2.Check your own help-desk and SSO flows
Require callback verification and phishing-resistant MFA for account and MFA resets; voice requests alone should never reset a login.
3.Ask the vendor what was exported, in writing
Ask which applications and fields were reached, the date range, and whether your organisation’s records were included.
McKesson confirmed a cybersecurity incident. Its Form 8-K (Item 7.01) says it discovered the incident on 25 August 2026 and has not determined that it is material.
Did McKesson have SOC 2 or ISO 27001 certification?+
We found no SOC 2 or ISO 27001 certification published by McKesson. That does not prove it had none; it means none was public.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by McKesson. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout