McKesson Corporation, posted by ShinyHunters

Threat Actor Profile

Per the reporting our sources hold, ShinyHunters is a data-theft extortion group rather than a classic encrypt-and-ransom operator, and it is the focus of a global FBI investigation (Reuters, via Security Affairs, reported an October 8 arrest tied to the probe). Our monitors recorded 18 postings by this group in the 90-day window, none in the last 7 days, with the earliest in the window dated 2026-08-22.

Victim & Industry Impact

McKesson is a large healthcare and pharmaceutical distribution company. The leak-site posting claims hundreds of millions of records spanning PII and PHI, but it does not itemise what was taken. Per BleepingComputer and SecurityWeek, McKesson has confirmed a data breach involving unauthorized access to third-party applications and data theft, and per The Register the Have I Been Pwned listing logs 6.4M leaked records. The 284 million figure is the attackers' claim, reported by CyberInsider and others.

Defensive Takeaway

Reporting on this incident does not name initial-access vectors for this group, so the following is general guidance on data-theft extortion: tightly govern third-party application integrations and OAuth tokens, enforce phishing-resistant MFA including for helpdesk and SaaS access, monitor for bulk data exfiltration, and rehearse incident response with legal and communications teams before an extortion deadline arrives.