What McKesson said
Pharmaceutical distribution giant McKesson discovered the incident on August 25, 2026 and disclosed it in an SEC 8-K. It confirmed unauthorized access to third-party applications and data exfiltration. The investigation was still early; the company had not deemed the event material at that point.
What ShinyHunters claims
The group told BleepingComputer it got in via vishing, using mckesson.claims, compromised Okta accounts and reached Salesforce and Snowflake. It claimed about 1 TB between August 21 and 25 and about 284 million records from Snowflake — later clarifying a row count, not unique people. It demanded about $55.2 million; according to the group, McKesson did not negotiate.
How to read it
The claims were not independently verified. The pattern matches ShinyHunters’ recent vishing campaign against healthcare and SaaS. Train support against fake help-desk calls and review Okta access to Snowflake/Salesforce.