McKesson, the largest pharmaceutical distributor in the United States, has confirmed a breach after the ShinyHunters extortion group claimed it stole data on 284 million patients from the company’s Salesforce and Snowflake environments. McKesson discovered the intrusion on August 25, 2026, and says its investigation is still in early stages. No exploit, no CVE — the entry point was two phone calls.

What happened

ShinyHunters told BleepingComputer it gained access through voice phishing against two McKesson employees. The pattern matches the group’s now well-worn Salesforce playbook: attackers call an employee posing as internal IT, walk them through “connecting a troubleshooting tool,” and direct them to Salesforce’s Connected Apps authorization screen, where the victim enters an eight-digit connection code read out over the phone. That code hands the attacker an OAuth-authorized connected app with the same data access as the employee — no password, MFA prompt, or malware required.

From that foothold, ShinyHunters pulled records out of both the Salesforce CRM instance and a linked Snowflake data warehouse. The group is now demanding $55,236,150 within 72 hours of first contact; McKesson has not engaged with the ransom demand, according to ShinyHunters.

What was taken

Per ShinyHunters’ own claims, the dataset spans patient identity data (names, addresses, dates of birth, phone numbers, emails, Social Security numbers), healthcare identifiers (patient IDs, medical record numbers, Medicaid numbers), and clinical detail (diagnoses, allergies, medications, disabilities, physician notes, appointment records) — plus hospice/terminal-illness status, sexual orientation fields, and predictive risk scoring data. Employee records (names, departments, roles) and physician/clinic contact data tied to McKesson’s distribution network are also claimed to be included. None of this has been independently verified by McKesson as of publication; the company has only confirmed unauthorized access to third-party applications.

Why this matters

McKesson distributes roughly a third of the pharmaceuticals used in the US and sits upstream of thousands of hospitals, clinics, and pharmacies. A breach at this altitude isn’t just a patient-notification problem — the physician and clinic contact data doubles as a target list for follow-on spear-phishing against the healthcare providers who depend on McKesson’s supply chain. Health-ISAC flagged rising ShinyHunters activity against healthcare targets back in July; this is that warning materializing at one of the sector’s largest distributors, and it follows the group’s near-identical hits on Cisco’s Salesforce instance and Instructure’s Canvas platform earlier this year via the same vishing-into-OAuth technique.

The recurring theme across all three: the vulnerability isn’t in Salesforce’s code, it’s in the trust an employee extends to a phone call and the breadth of access a connected-app authorization silently grants.

Mitigation

  • Restrict who can create or authorize Salesforce Connected Apps; require admin approval for any new connected app rather than allowing self-service authorization.
  • Enforce IP-based access restrictions and session policies on Salesforce and Snowflake so an authorized token from an unexpected network location gets flagged or blocked.
  • Deploy Salesforce Shield (or equivalent) to alert on bulk data exports, unusual API query volume, and new connected-app grants in near real time.
  • Add vishing and “verify the caller, don’t trust the caller ID” scenarios to security awareness training — specifically the “read me the code on your screen” pattern, which has now been used against Cisco, Instructure, and McKesson.
  • Audit existing connected-app authorizations in Salesforce and Snowflake for anything unrecognized, and revoke OAuth grants that aren’t tied to a documented integration.
  • Healthcare orgs and providers with a McKesson relationship should treat any inbound contact referencing McKesson account details with elevated scrutiny until McKesson’s investigation clarifies scope.

McKesson has not published a formal advisory beyond its breach disclosure; expect updates as the investigation progresses.