🕒 Created · Updated

McKesson Corporation Confirms Cyberattack and Data Breach Affecting Oncology and Medical-Surgical Business Units

McKesson Corporation, a Texas-based pharmaceutical distribution giant, confirmed a cybersecurity incident discovered on August 25, 2026. The breach involved unauthorized access to third-party applications, resulting in the exfiltration of data from its Oncology & Multispecialty and Medical-Surgical business units. The ShinyHunters hacking group claimed responsibility for the attack, stating they gained access through voice phishing and social engineering tricks used against employees. The group reported stealing approximately 284 million records, including personally identifiable information and protected health information. ShinyHunters demanded a $55 million ransom from the company to prevent the public release of the stolen files. McKesson Corporation stated that its services and network capabilities remain operational, and the company continues to accept orders and ship products. The company provided complimentary credit monitoring and identity protection services to the impacted individuals. Attorneys are currently investigating whether a class action lawsuit can be filed to recover compensation for those whose information was exposed.

Sources