MCKESSON CORP
Aug 2026 · Graded Verified · Wholesale and Distribution · Government record
Incident summary
MCKESSON CORPAug 2026
Not yet quantified
VVerifiedShinyHunters claims it vished several McKesson employees' Okta credentials, then walked those single sign-on logins straight into Salesforce and Snowflake. McKesson has not confirmed the entry point or the data taken; only the extortion group has spoken. Single sign-on was built to make log-ins easy, but when secured incorrectly (or not at all) it is just the easy button to own an entire company. The group claims roughly 284 million patient records, the kind of data no reset can undo.
Wholesale and Distribution
SEC 8-K, Item 7.01
Initial attack type phishing or social engineering inferred · Impact data theft inferred + data extortion · Actor ShinyHunters
About this record
This incident is on the public government record: an SEC 8-K filing or a state-regulator notification, graded Verified. Every figure links to the source it was read from; if we have read one wrong, tell us at info@hackerinahoodie.com. This index never sums figures across incidents. See the methodology.