September 1, 2026 — Healthcare and pharmaceutical services giant McKesson Corporation has confirmed that attackers accessed its systems and removed customer-related data, as the cybercriminal group ShinyHunters threatens to publish information it claims to have stolen from the company.
McKesson disclosed the cybersecurity incident after discovering unauthorized activity on August 25. The company said the incident involved third-party applications and resulted in data being taken from its systems.
According to McKesson, the affected information relates to a limited group of customers associated with its Oncology & Multispecialty and Medical-Surgical business units.
The company said it has disrupted the unauthorized access and that its operations have continued normally. Orders are still being processed and products shipped through its distribution network.
ShinyHunters claims massive data theft
The disclosure came as the ShinyHunters extortion operation reportedly listed McKesson on its leak site and issued a ransom demand.
The group is threatening to release the allegedly stolen information unless McKesson begins negotiations by September 1.
ShinyHunters has reportedly claimed that it obtained approximately 284 million customer records and is seeking about $55 million from the healthcare company.
Those figures have not been independently verified, and McKesson has not confirmed the amount of data allegedly stolen or the ransom figure.
Potentially sensitive healthcare information
The attackers have reportedly claimed that the stolen material includes a broad range of sensitive information. Alleged data categories include personally identifiable information, protected health information, medical and treatment details, prescription and billing records, employee information, and information connected to physicians and medical clinics that work with McKesson.
McKesson has not yet publicly confirmed which specific categories of information were taken or how many individuals may ultimately be affected.
The company has said that people determined to have been impacted will receive complimentary credit monitoring and identity protection services.
McKesson says operations remain unaffected
Despite the breach, McKesson says there has been no disruption to its core business operations.
The company continues to provide services and products to healthcare providers, pharmacies, pharmaceutical and biotechnology companies, manufacturers, government organizations and other customers.
McKesson plays a major role in the North American healthcare supply chain, distributing a substantial share of prescription medicines used by hospitals, pharmacies and clinics. Its operations also include medical supplies, specialty care and cancer-treatment services, as well as the Health Mart pharmacy network.
The company has not indicated that it is shutting down or disconnecting major systems as a result of the incident.
Investigation continues
McKesson’s initial disclosures provide limited information about how the attackers gained access, how long they remained inside the environment or the precise volume of information removed.
The company is continuing to investigate the incident and assess its potential impact.
The situation also illustrates the growing pressure faced by healthcare organizations targeted by extortion groups. Medical and pharmaceutical companies hold large quantities of sensitive personal and health information, making them attractive targets for cybercriminals seeking both financial payments and leverage through the threat of public disclosure.
For now, the scale of the McKesson incident remains uncertain. While the company has confirmed unauthorized access and data exfiltration, the much larger figures and detailed data claims made by ShinyHunters remain allegations pending further verification.
