# ShinyHunters Extortion Group Claims 284M-Record McKesson Corporation Data Breach via Vishing and Salesforce/Snowflake Compromise

> ShinyHunters claims to have stolen roughly 284 million data records (~1TB, exfiltrated Aug 21-25, 2026) from healthcare distributor McKesson Corporation by vishing employees, registering the lookalike domain mckesson[.]claims, compromising employee Okta SSO accounts, and pivoting into McKesson's Salesforce and Snowflake environments. The group is demanding $55,236,150 with a 72-hour deadline that has since lapsed without payment; McKesson disclosed the incident on August 28, 2026 and says its investigation is in early stages with no material impact yet determined.

- **Published:** 2026-08-29T00:00:00Z
- **Last reviewed:** 2026-08-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2208
- **ID:** TL-2026-2208
- **Severity:** CRITICAL
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Actor:** ShinyHunters
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On August 28, 2026, healthcare and pharmaceutical distribution giant McKesson Corporation disclosed a cybersecurity incident describing 'unauthorized access to third-party applications and exfiltration of data,' after the ShinyHunters extortion group told BleepingComputer it had stolen approximately 284 million data records (~1TB) from the company. ShinyHunters says the intrusion began with voice-phishing (vishing) calls against McKesson employees, in which callers impersonated internal IT/help-desk or security staff and directed targets to a fraudulent single sign-on (SSO) page. The group registered the lookalike domain mckesson[.]claims to support this impersonation, following a broader ShinyHunters domain-generation pattern -- registering 'company[.]claims' lookalike domains keyed to each target's name or abbreviation -- that ReliaQuest's Threat Research team publicly warned about on August 17, 2026, days before ReliaQuest itself was targeted via reliaquest[.]claims (one employee entered credentials and approved a fraudulent MFA push, granting brief view-only access to ReliaQuest's identity dashboard before device-trust controls blocked further movement; no ReliaQuest customer data was confirmed stolen).

Against McKesson, ShinyHunters claims the vishing calls led to compromise of multiple employees' Okta SSO accounts, which were then used to access McKesson's Salesforce environment (described by the actor as 'fully compromised,' including support cases) and a larger volume of patient-related data held in Snowflake. The actor states exfiltration ran over four days, August 21-25, 2026, totaling roughly 1TB / 284 million records -- a figure ShinyHunters itself later clarified is a raw row/line count rather than a count of unique individuals, consistent with the group's history of overstated headline numbers. Claimed stolen data spans patient PII/PHI (names, addresses, dates of birth, SSNs, patient IDs, phone numbers, email addresses, Medicaid numbers, medical record numbers, medication/allergy information, illnesses, disabilities, appointment information), physician/provider data, employee records, and internal Salesforce support-case communications.

McKesson discovered the incident on August 25, 2026 and activated its incident response protocols; the same day, ShinyHunters issued a $55,236,150 ransom demand with a 72-hour deadline. As of McKesson's August 28 public disclosure, the company had not responded to or negotiated with the group, and the deadline had lapsed without payment. McKesson's statement describes the investigation as being in 'early stages' with no determination yet of material impact.

ShinyHunters is tracked as a loose, multinational criminal ecosystem (aliases/personas include ShinyCorp and members using handles such as Hollow, Noct, and Depressed) operating alongside and overlapping with the Scattered Spider and Lapsus$ collectives under the broader 'Scattered LAPSUS$ Hunters' (SLSH) umbrella; industry tracking designations for related activity clusters include UNC6040 (the Salesforce-vishing cluster), among others. The group has run a sustained campaign of Okta/SSO vishing against SaaS environments (Salesforce, Snowflake) through 2025-2026, with prior high-profile incidents including the Salesloft/Drift OAuth-token campaign (~1.5 billion records across roughly 760 Salesforce orgs, Aug-Sep 2025), the Gainsight-linked Salesforce campaign (200+ instances, Nov 2025), a wave of Okta-vishing intrusions against Wynn Resorts, Panera Bread, Harvard, Princeton, and the University of Pennsylvania (Jan 2026), and the Instructure/Canvas breach (275M records / 3.65TB, Apr-May 2026). Several affiliates have been arrested since 2022-2025 (including Sebastien Raoult and Matthew D. Lane), but the group's decentralized structure has allowed operations to continue.

## MITRE ATT&CK

- T1589.002 Gather Victim Identity Information: Email Addresses
- T1583.001 Acquire Infrastructure: Domains
- T1566.004 Phishing: Spearphishing Voice
- T1078.004 Valid Accounts: Cloud Accounts
- T1621 Multi-Factor Authentication Request Generation
- T1078.004 Valid Accounts: Cloud Accounts
- T1078.004 Valid Accounts: Cloud Accounts
- T1684.001 Impersonation
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [McKesson discloses breach after ShinyHunters claims patient data theft](https://www.bleepingcomputer.com/news/security/mckesson-discloses-breach-after-shinyhunters-claims-patient-data-theft/)
- [ShinyHunters claims McKesson data breach exposing 284 million patients](https://cyberinsider.com/mckesson-data-breach-exposing-284-million-patients/)
- [Ransomware.live victim listing: McKesson Corporation (ShinyHunters)](https://www.ransomware.live/group/shinyhunters)
- [ReliaQuest confirms failed data-theft attack after ShinyHunters breach](https://www.bleepingcomputer.com/news/security/reliaquest-confirms-failed-data-theft-attack-after-shinyhunters-breach/)
- [ShinyHunters Threat Actor Profile: TTPs, IoCs & Attacks](https://www.huntress.com/threat-library/threat-actors/shinyhunters)
- [McKesson is investigating a cybersecurity incident after ShinyHunters claims patient data theft](https://databreaches.net/2026/08/28/mckesson-is-investigating-a-cybersecurity-incident-after-shinyhunters-claims-patient-data-theft/)
- [Behind the breach: ShinyHunters' 2026 voice phishing campaign](https://www.obsidiansecurity.com/blog/behind-the-breach-shinyhunters-2026-voice-phishing-campaign)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2208