McKesson data taken from third-party applications through compromised employee accounts
McKesson said it learned on August 25, 2026 of a cybersecurity incident targeting employee corporate accounts and involving third-party applications, with unauthorized access and exfiltration of data between August 20 and 25; it filed an SEC Form 8-K on August 28 and a Notice of Data Breach on September 8. On September 21 it said the access was limited to certain third-party applications, affecting a subset of Oncology and Multispecialty customers and mainly business contact and order data in its Medical-Surgical business. ShinyHunters claimed it voice-phished employees into their Okta single sign-on accounts and used them to reach Salesforce and Snowflake; McKesson has not said how access was gained, so that chain is the attackers' unverified claim.
- Victim
- McKesson
- Industry
- Healthcare
- Country
- United States
- Intrusion began
- Aug 20, 2026
- First disclosed
- Aug 28, 2026
- Actor
- ShinyHunters (claimed) (Extortion group)
- Attributed group
- ShinyHunters
- Initial access
- Stolen credentials
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Compromised employee corporate accounts were enough to pull data out of third-party applications. Phishing-resistant MFA on those accounts, caller verification before any credential or MFA change, and alerts on bulk exports from SaaS reached through SSO are the controls, whichever entry point is finally confirmed.
Regulatory and legal outcome
From September 2026, putative class action lawsuits were filed against McKesson in the U.S. District Court for the Northern District of Texas, the first O'Connor v. McKesson Corporation; they were pending at its Form 10-Q filed November 4, 2026.
Sources
- Notice of Data Breach, McKesson, Sep 8, 2026
- Form 8-K, Item 7.01: cybersecurity incident discovered August 25, 2026, McKesson via SEC EDGAR, Aug 28, 2026
- McKesson Cybersecurity Incident Investigation and Response Update, McKesson, Sep 21, 2026
- Form 10-Q for the quarter ended September 30, 2026 (litigation note), McKesson via SEC EDGAR, Nov 4, 2026
- McKesson discloses breach after ShinyHunters claims patient data theft, BleepingComputer, Aug 28, 2026
- McKesson Confirms Data Breach as Attacker Deadline Looms, SecurityWeek, Aug 31, 2026
- ShinyHunters expose 6.4M in attack on medical supplier McKesson, The Register, Sep 10, 2026
Record verified Nov 5, 2026 against the sources above. Corrections: contact us.
Related incidents
- Change Healthcare ransomware via a Citrix remote access portal without MFA 2024 · Stolen credentials
- RingCentral customer data stolen after a social engineering attack 2026 · Credential phishing
- PowerSchool SIS data theft through a compromised support-portal credential 2025 · Stolen credentials
- AT&T call and text records stolen from its Snowflake workspace 2024 · Stolen credentials
Cite this record
SWI Community Team. (2026). McKesson data taken from third-party applications through compromised employee accounts. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-mckesson-employee-accounts-third-party-apps/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.