IRVING, 30 AUG 2026 — McKesson has confirmed unauthorised access to third-party applications and the theft of data. The attackers say they got in by telephoning employees. None of that access touched McKesson's own network.
What McKesson has confirmed, and what it has not
The company's statement is short and it is careful. McKesson says it is in the early stages of investigating an incident involving third-party applications and the unauthorised access and exfiltration of data. It has not said how many people are affected, what categories of information were taken, or whether the incident is material.
Everything more specific than that comes from the extortion group. ShinyHunters told reporters it took roughly 284 million records over four days, from 21 to 25 August, out of Salesforce and Snowflake environments, amounting to about a terabyte, and that it has demanded US$55,236,150.
The record count is not a headcount, and even the attackers say so
284 million is being reported as a number of patients. It is a number of rows.
The distinction matters more here than in most breaches, because the systems named are a customer relationship platform and an analytics warehouse. Both are built to hold many rows per person: an order, a claim line, an appointment, a refill, each a separate record. A single individual can account for dozens.
Most tellingly, the attackers themselves declined to convert the figure. Asked how many people the data covers, ShinyHunters said the records are linked to tens of millions of patients and that the exact number is not yet known. When the party with every commercial reason to inflate a number will not state one, the data probably does not yield it.
We have covered the general form of this before, when the same group claimed 25 million Alcon records and published data containing 218,000 unique email addresses, and when a French education breach was counted in lines rather than people. This is the third instance in a month. The pattern is now established well enough that a claimed figure should be treated as a unit of unknown denomination until the victim publishes one.
The route in was a telephone call and a single sign-on
The most distinct part of the incident is also the one getting the least attention.
The attackers describe voice-phishing McKesson employees while impersonating the help desk and IT teams, using a look-alike domain registered for the purpose. That gave them Okta single sign-on credentials. Those credentials, in turn, opened Salesforce and Snowflake.
The chain contains no exploit. No vulnerability, no unpatched server, no malware. A persuasive phone call yielded credentials, and an identity provider then did exactly what it was bought to do, which is turn one successful authentication into access across the estate.
Consolidation is the story, twice
For a phone call to reach clinical data, two separate kinds of consolidation had to be in place, and both are common, recommended practice.
The first is identity. Single sign-on exists because managing dozens of separate credentials is worse: it produces password reuse, orphaned accounts and no central revocation. Okta and its competitors solved a real problem. The cost of solving it is that the blast radius of one compromised identity is now the whole application estate rather than one application.
The second is data. A cloud warehouse exists because analytics across separated systems is painful and slow. Consolidating into Snowflake makes the analysis possible. It also means that the answer to the question of what an attacker gets from one credential is no longer a departmental extract but the joined set.
Neither of these is an argument against single sign-on or against warehousing. Both remain the right default, and the alternative — scattered credentials and scattered data — fails more often and more quietly. Both changes moved risk instead of removing it, consolidating many small compromises into one large one. The controls that matter in that model are different ones.
What actually reduces this, given the vector
Perimeter controls are irrelevant to an attack that uses legitimate credentials. The list of what does work is short and uncomfortable.
Phishing-resistant authentication is the first item, because it is the one that would have broken this chain. Hardware-bound credentials cannot be read out over a telephone, which is what separates them from a code an employee can recite to someone claiming to be the help desk. The prior Snowflake extortion campaign turned on the same weakness, and the guilty plea in that case confirmed the way in was still just a password.
Help-desk verification procedure is the second, because the attack targeted the process rather than the technology. An identity-reset path that a caller can talk their way through is a credential-issuing service available to anyone who sounds convincing.
Egress limits on the warehouse are the third. A terabyte leaving Snowflake over four days is a detectable event if anyone has defined what a normal query volume looks like, and it is invisible if nobody has.
For readers outside the United States
The regulatory consequences are American, but the operational lesson is not.
Healthcare and pharmaceutical distribution in Singapore, Malaysia and across ASEAN runs on the same platforms, frequently the same three named in this incident, and often with a smaller security function watching them. The Personal Data Protection Act in Singapore and the equivalents in the region impose notification duties that turn on the same unresolved question McKesson faces now, which is how many people are actually in the data.
That question can only be answered by reconstructing identity from rows, which is why breach notifications take months. The headline number arrives on day one. The number in the notification letter arrives much later, and it is usually smaller.
View author profile → · Editorial policy
