Breach at a glance
On August 28–29, 2026, BleepingComputer and CyberNews reported that threat group ShinyHunters is claiming responsibility for a breach of McKesson Corporation, the largest pharmaceutical distributor in the United States. According to the group, the operation ran from August 21 to August 25 and targeted McKesson’s Snowflake and Salesforce cloud environments, yielding approximately 1TB of data containing 284 million records. McKesson discovered the incident on August 25 and confirmed it that same day by filing a Form 8-K with the US Securities and Exchange Commission.
McKesson has not confirmed the 284 million figure, the data types, or the attack vector. Until the company completes its forensic investigation and issues official notifications, every number attributed to ShinyHunters should be treated as claimed rather than established. What is established is that McKesson experienced a cybersecurity incident serious enough to trigger an SEC 8-K disclosure, and that a high-profile ransomware-adjacent group is claiming credit with a $55.2M demand.
How could attackers have accessed Snowflake and Salesforce simultaneously?
ShinyHunters has a documented pattern of using bulk-harvested credentials to compromise cloud SaaS tenants at scale. In 2024, the group ran a campaign against Snowflake customers — including AT&T, Ticketmaster, and Advance Auto Parts — exploiting accounts that had no multi-factor authentication (MFA) enforced on the Snowflake tenant. Credentials for those accounts were collected months earlier by infostealers running on developer laptops, CI/CD systems, and contractor machines.
The mechanism is straightforward: a user installs an infostealer (often distributed via phishing or a trojanized tool), the malware harvests saved browser credentials and token files, and those credentials are sold or retained for later use. If the target SaaS platform does not require MFA per-session, or if the attacker obtains a valid session token directly, they can authenticate without triggering password-based detection. Snowflake accounts, Salesforce connected apps, and service accounts used for ETL or data pipelines are common targets because they often hold bulk read access to business-critical data and are frequently excluded from MFA enforcement policies that cover end-user login flows.
If McKesson’s investigation confirms a credential-based entry vector, it would follow the same pattern ShinyHunters used in 2024: no vulnerability in Snowflake or Salesforce products themselves, but a gap in the customer’s access controls applied to those platforms.
What McKesson has and has not confirmed
The Form 8-K filing establishes that McKesson believes a cybersecurity incident occurred on or before August 25, 2026. SEC disclosure rules require a public company to file Form 8-K within four business days of determining that a cybersecurity incident “is material or reasonably likely to be material.” The filing itself does not describe the scope, vector, or data affected; those details typically emerge in subsequent 10-Q or 10-K filings, supplemental 8-K amendments, or through mandatory regulatory notifications.
McKesson has not confirmed that ShinyHunters was responsible. It has not confirmed that Snowflake or Salesforce were involved. It has not confirmed that any patient data was accessed, and it has not confirmed the 284 million figure. The company’s investigation was ongoing as of the time of publication. McKesson operates as a covered entity and business associate under HIPAA across its pharmacy distribution and technology services businesses; if PHI was accessed, it has mandatory notification obligations regardless of whether it chooses to comment publicly on ShinyHunters’ claim.
What it means for US healthcare software teams
Whether or not ShinyHunters’ numbers prove accurate, the pattern of the alleged attack is directly instructive for any team building or running healthcare software that stores PHI in cloud analytics or CRM platforms.
HIPAA breach notification timelines are fixed. If the investigation confirms that PHI was accessed without authorization, the 60-day clock for individual notification started on McKesson’s discovery date (August 25). For breaches affecting 500 or more individuals per US state, McKesson must also notify the HHS Office for Civil Rights (OCR) and provide notice to prominent media outlets in those states within the same 60-day window. Teams building on top of McKesson’s data infrastructure — including pharmacy systems, health data warehouses, and supply-chain analytics platforms — should check their Business Associate Agreements (BAAs) now to understand where their own notification obligations begin.
Bulk data access controls in Snowflake are not optional. Snowflake’s platform allows customers to configure MFA enforcement, network policies, and row-access policies at the account level. Many organizations enable MFA for end-user BI tools but leave service accounts and ETL connections on single-factor API keys. A single compromised API key or browser-session token can give an attacker the same ACCOUNTADMIN-equivalent access it takes a DBA months to build. If your Snowflake tenant stores PHI — claims data, lab results, prescription history — service accounts must be rotated frequently, MFA or certificate-based authentication must be enforced for all connection types, and network policies should restrict access to known IP ranges.
Salesforce connected apps are a common data exfiltration point. Connected apps with bulk API access (“Chatter API” or standard API scope) can be used to export large volumes of records with a single OAuth token. Review which connected apps in your Salesforce org have full API access or no IP restrictions. Token expiry and refresh token revocation should be automated, not manual.
The 284 million scale reflects how quickly bulk data exports move. ShinyHunters claims the entire operation ran from August 21 to August 25 — five days. At 284 million records, that implies an average export rate in the hundreds of millions of rows per day. Snowflake’s COPY INTO command and Salesforce’s Bulk API are both designed for exactly this kind of throughput. SIEM and DLP tools that alert on anomalous data volume exports are the primary detection mechanism; they must be tuned specifically for bulk-export API activity, not just interactive query volume.
Immediate hardening checklist for teams storing PHI in cloud SaaS
- Snowflake: enforce MFA for all users and service accounts. Run
SHOW USERSand checkHAS_MFA. Service accounts authenticating via key-pair or OAuth should use short-lived tokens (15-minute expiry) and IP network policies restricted to known ranges. - Snowflake: audit ACCOUNTADMIN and SYSADMIN grant chains. Run
SHOW GRANTS ON ROLE ACCOUNTADMINand trace every user who can escalate to that role. Revoke grants that predate the last access review. - Snowflake: review QUERY_HISTORY for Aug 21–25. Look for COPY INTO EXTERNAL STAGE commands, large SELECT * with high row counts, and logins from IP ranges not in your network policy. This is your breach indicator for anyone using the same platforms as McKesson.
- Salesforce: audit connected apps with API scope. Navigate to Setup → Connected Apps → Manage and review apps with full API or chatter API access. Check IP relaxation settings and token lifetimes.
- Salesforce: rotate integration credentials. Any Salesforce integration (ETL, BI, external portals) authenticating with username/password should be migrated to connected app OAuth flows with short token lifetimes and IP restrictions.
- BAA review. If you use McKesson data infrastructure as a downstream consumer, pull your BAA now. Check what breach notification timelines it specifies and whether it requires McKesson to notify you within a specific window if your covered data is involved.
- SIEM alerting on bulk export APIs. If your SIEM does not alert on anomalous bulk API usage (Snowflake COPY INTO, Salesforce Bulk API query volume), add those detections before your next sprint ends.
Frequently asked questions
Has McKesson confirmed that 284 million records were stolen?
No. McKesson confirmed an incident occurred via SEC Form 8-K filed August 25, 2026, but has not confirmed the scale, vector, or data types claimed by ShinyHunters. The 284 million figure comes from the threat group’s own posting and should be treated as unverified until McKesson completes its investigation and issues official notifications.
What data types does ShinyHunters claim to have stolen from McKesson?
ShinyHunters claims the stolen data includes Social Security Numbers, diagnoses, prescription records, and medical record numbers. These categories, if confirmed, would constitute protected health information (PHI) under HIPAA, triggering mandatory breach notification to affected individuals, HHS, and potentially state regulators. McKesson has not confirmed these data types.
What HIPAA notification obligations does McKesson face after a breach of this scale?
Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals within 60 days of discovering a breach. Breaches affecting 500 or more individuals in a given state require simultaneous notification to prominent media outlets in that state. All breaches affecting 500 or more individuals must be reported to HHS Office for Civil Rights (OCR) within 60 days of discovery. McKesson discovered the incident August 25, 2026; the 60-day notification deadline falls on October 24, 2026.
How could attackers breach both Snowflake and Salesforce at McKesson simultaneously?
ShinyHunters has historically used bulk stolen credentials — harvested by infostealers from developer machines, CI environments, and credential databases — to compromise cloud SaaS tenants that lack MFA enforcement. In the 2024 Snowflake campaign, the group leveraged credentials stolen months earlier to access dozens of large tenants without triggering anomaly detection, because the logins appeared from known IP ranges. Salesforce accounts with single-factor login, especially service accounts used for ETL or integrations, are similarly vulnerable. One compromised privileged cloud account can expose bulk data export APIs across both platforms within hours.
Sources
BleepingComputer — McKesson discloses breach after ShinyHunters claims patient data theft (August 28–29, 2026)
CyberNews — McKesson breached: ShinyHunters claims 284M records (August 28–29, 2026)
SEC EDGAR — McKesson Corporation (CIK 0000927653) Form 8-K filings