McKesson confirms cybersecurity incident as ShinyHunters claims 284 million records
Claims of compromised SSO and SaaS environments show why identity has become the perimeter for data held in third-party apps.
McKesson, one of the largest pharmaceutical distributors in North America, has confirmed a cybersecurity incident involving third-party applications after the ShinyHunters extortion group claimed to have stolen a large volume of patient and customer data, BleepingComputer reported on 28 August. The company said it discovered the incident on 25 August.
In a Form 8-K filing with the US Securities and Exchange Commission referencing the 25 August event, McKesson said that upon discovery it activated its incident response protocols, launched an investigation and engaged outside cybersecurity experts. The company said it had not determined that the incident was material to its financial condition or operations as of the filing, and that the investigation into the full scope is ongoing. McKesson has notified customers and warned that some services could be degraded.
ShinyHunters has claimed responsibility. According to the report, the group says it exfiltrated roughly 1 TB of data between 21 and 25 August, amounting to about 284 million records, a figure that reflects rows of data rather than unique individuals. The group says it demanded $55,236,150 and gave McKesson 72 hours from 25 August to respond. ShinyHunters claims the access came through compromised Okta single sign-on accounts and extended to Salesforce and Snowflake environments. McKesson has not publicly identified which third-party applications were involved.
The data the group claims to hold includes names, addresses, dates of birth, Social Security numbers, patient and medical record identifiers, phone numbers and email addresses, Medicaid numbers, medication and allergy information, diagnoses and disabilities, appointment details, physician information, employee data and Salesforce records. None of these claims has been confirmed by McKesson.
Why it matters
Large organisations increasingly hold their most sensitive data in SaaS platforms rather than on servers they run themselves, so a compromised identity provider account can open several systems at once. The incident illustrates why identity, session and API-token security have become the centre of enterprise defence. It also shows how extortion groups use record counts and deadlines to apply pressure before an investigation has concluded. Healthcare data remains among the most sought-after targets because it cannot be reissued like a password.
Compromised SSO accounts
ShinyHunters claims Okta single sign-on accounts were taken over.
SaaS platforms reached
The group claims access extended to Salesforce and Snowflake environments.
Bulk export, 21-25 August
Roughly 1 TB and about 284 million records claimed; records are rows, not unique people.
Extortion demand
$55,236,150 demanded with a 72-hour deadline from 25 August.
Company response
Incident discovered 25 August; response protocols activated, experts engaged, 8-K filed, investigation ongoing.
What you can learn from this
- Single sign-on concentrates both convenience and risk. SSO lets one identity, verified once, open many applications through protocols such as SAML or OpenID Connect. The identity provider issues signed assertions that each application trusts, so applications do not check passwords themselves. This is efficient, but it means a compromised account at the provider inherits access to every connected app. Strong phishing-resistant authentication, such as hardware security keys, matters most precisely at this chokepoint. Session tokens issued after login are just as valuable, which is why attackers target browser sessions as well as passwords.
- SaaS data lives outside your network perimeter. Customer relationship and data-warehouse platforms are reachable from anywhere with valid credentials, because that is what makes them useful. Network firewalls provide no protection for data an attacker can pull over an authenticated API from their own machine. The controls that apply are identity-based: conditional access policies that require managed devices or known locations, IP allow-lists where the platform supports them, and least-privilege roles. Treating "logged in" as sufficient is what makes bulk export possible.
- Bulk export leaves a trail. Pulling a terabyte from a data platform requires many API calls or large query results over hours or days. Platforms record these in audit logs, and unusual volumes, unfamiliar client applications and off-hours access stand out against normal usage. Detection works here because legitimate users rarely export whole tables. Alerting on export volume per identity is one of the highest-value rules for SaaS environments. Retention matters too: logs kept for only a few days cannot show an export that happened last week.
- Record counts are not people counts. A database row might represent a prescription, an appointment or a message, so a single patient can account for hundreds of rows. Attackers quote the largest number available because it increases pressure, while investigations take time to map rows to individuals. Materiality determinations under securities rules depend on impact, which is why companies state that the assessment is still open. Reading breach claims carefully means asking what a "record" is.
- Third-party risk is your risk. When a business process runs in a vendor's platform, the data owner remains responsible for its protection even though the vendor operates the infrastructure. Shared responsibility models spell out who secures what: the vendor secures the platform, the customer configures identities, permissions and integrations. Many SaaS incidents involve the customer's side of that line. Knowing exactly which integrations and service accounts have access to each platform is the starting point.
We teach this
How to use this in practice
- List every application connected to your identity provider. In whatever SSO or account system you administer, even a small Google Workspace or Microsoft 365 tenant, export the list of connected applications and OAuth grants. For each, note who owns it and whether it still needs access. Pay particular attention to grants with read access to entire mailboxes, drives or customer tables, since those are the ones that enable bulk export. Done looks like a list with at least one stale grant revoked.
- Enable phishing-resistant MFA on your own admin accounts. Register a hardware security key or platform passkey on the highest-privilege account you hold and disable SMS or voice codes as fallbacks. Test a login from a fresh browser to confirm the key is required. Done looks like a login that succeeds only with the key, plus a recovery method you have written down and stored offline.
- Find the export log in one SaaS platform. Pick a platform you use (a CRM, a data warehouse, a file store), locate its audit or event log, and find the events that correspond to a large download or report export. Run a small export yourself and confirm that it appears with your identity and a timestamp. If the platform offers a separate data-export or bulk-API permission, check who holds it. Done looks like a saved search or alert that fires when export volume for one user exceeds a threshold you choose.
- Map one data flow to a third party. For a single business process, draw where a record originates, which SaaS platforms it passes through, which service accounts move it, and where it is stored at rest. Mark which party is responsible for security at each hop. Then write down what would happen to the process if each service account were disabled for a day, which tells you how much access each one truly needs. Done looks like a diagram with no hop lacking an owner.
Sources
- McKesson discloses breach after ShinyHunters claims patient data theft — BleepingComputer
Our reporting is an original summary; full coverage is at the links above.
Don't just read about it — build it.
Square 1 teaches the skills behind the headlines, with every line of your work graded by AI. Find your starting point in 3 minutes.
Get your free skill report