# McKesson breach started with vishing against Okta SSO, then reached Salesforce and Snowflake

Source: https://startwithidentity.com/blog/2026-08-28-mckesson-breach-vishing-okta-sso-salesforce-snowflake/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

McKesson disclosed on August 28, 2026 that attackers gained unauthorized access to third-party applications and stole data. Reporting indicates the entry point was voice phishing against multiple employees from the lookalike domain `mckesson[.]claims`, matching a documented ShinyHunters pattern, with the callers impersonating help desk and IT staff. That yielded employee [Okta](https://startwithidentity.com/vendors/iam/okta/) credentials, and the resulting SSO session opened Salesforce, including support cases, and Snowflake. Exfiltration ran August 21 to 25 and totalled roughly one terabyte; McKesson discovered it on August 25. ShinyHunters claims about 284 million records, a raw row count rather than unique individuals, and demanded 55.2 million dollars.

## Why it matters

Nothing was exploited here. A human answered the phone, and [single sign-on](https://startwithidentity.com/glossary/sso/) did the rest, which is the trade every SSO deployment makes: one credential, many downstream systems, and a blast radius equal to the union of them. Healthcare distribution makes the data unusually sensitive, but the mechanics are identical to the [Scattered Spider help desk playbook](https://startwithidentity.com/breaches/scattered-spider-helpdesk-social-engineering/) and to the [Snowflake 2024](https://startwithidentity.com/breaches/snowflake-2024-credential-attacks/) campaign. The controls that would have changed the outcome are known: [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) so a relayed code is worthless, a help desk identity-verification procedure that does not rely on caller-supplied facts, [step-up authentication](https://startwithidentity.com/glossary/step-up-auth/) on data-platform access, and egress monitoring on SaaS connectors sized to catch a terabyte moving over four days.

Source: [BleepingComputer](https://www.bleepingcomputer.com/news/security/mckesson-discloses-breach-after-shinyhunters-claims-patient-data-theft/)