2026 McKesson — ShinyHunters exfil; HIBP ~6.4M unique emails; SEC confirms third-party app incident
Data compromised
Company notice: names, addresses, phones, emails, patient IDs, DOB, and/or medical/insurance/claims/payment elements varying by person. HIBP analysis of leaked corpus: ~6.4 million unique email addresses (marketing, patients, staff, providers) — not the actor’s 284M raw-row claim. SSN claims by actor not confirmed in HIBP field summary.
Technical writeup
Verified McKesson SEC 8-K / company notice — August 2026 incident (Aug 20–25), with HIBP scale update September 2026. Unauthorized access via employee corporate accounts / third-party apps; data exfiltrated. ShinyHunters claimed ~284M rows; Have I Been Pwned counted ~6.4M unique emails in the published corpus. Company review of individual impact ongoing. recordsAffected 6400000 (HIBP unique emails); companyConfirmed true.
Root cause
ShinyHunters claims vishing via mckesson.claims impersonation then Okta SSO access to Salesforce and Snowflake (~1TB Aug 21–25); McKesson SEC 8-K and customer notice confirm third-party application unauthorized access/exfiltration (discovered Aug 25)