What happened
In August 2026, McKesson, a healthcare and pharmaceutical distribution company, was the target of a “pay or leak” extortion campaign by a threat group calling itself ShinyHunters. The group later published a large body of data it claimed was taken from the company. The breach catalogue tied to this incident records 6,404,340 unique email addresses, alongside several other personal and professional attributes. In its disclosure notice, McKesson said it had identified unauthorized access to certain third-party applications, that the data was associated with a subset of customers within its Oncology & Multispecialty and Medical-Surgical business units, and that it had reasonable assurance of no ongoing unauthorized activity. The company detected the incident on August 25, 2026 and reported it to the SEC in a Form 8-K filing. It has not said how many people are affected; the 6.4 million figure comes from the published data, not from McKesson.
What the catalogue lists as exposed
The breach catalogue lists the following data types for this incident:
- Names
- Email addresses
- Physical addresses
- Phone numbers
- Dates of birth
- Genders
- Employers
- Personal health data
Personal health data is the most sensitive item on this list. A name, a date of birth, and a clinical detail together are enough to impersonate a patient at a call center, to file a fraudulent insurance claim, or to pressure someone who has private knowledge of a condition. A phone number and an email address, on their own, are routine. Combined with a name, an employer, and a clinical context, they make a phishing message much harder to spot, because the sender appears to already know who you are and what you do.
Who is affected
The HIBP description of the breach says the data covers a mix of roles: marketing campaign recipients, patients, staff at McKesson, and contacts at outside healthcare providers. If your business buys medical or surgical supplies from McKesson, your own contact details may be in the file, because contacts at outside healthcare providers are part of it. A staff member at a clinic or a physician’s office may be on McKesson’s contact list, and their work email, employer name, and job context are now in a public dataset. That combination is exactly what a convincing vendor or invoice scam needs. For owners who are patients of oncology or specialty practices, the personal health information and contact details can also feed outreach that looks as though it comes from a real provider.
What to do this week
- Treat any email, call, or text that mentions a recent medical visit, a prescription, or an insurance matter with caution, even if it includes your name and a date of birth. Confirm by calling the provider back on a number you find yourself, not one in the message.
- Ask any staff member who orders from McKesson or works with oncology or surgical suppliers to flag unexpected invoices, purchase orders, or requests to change payment details. Confirm each one through a second channel, such as a known phone number, before acting on it.
- Watch your mailbox and your insurer portals for explanations of benefits that list services you did not receive. Personal health data can be used to file false claims in your name, and these notices are often the first sign that someone has tried.
Check if you were affected
You can search your email address on our McKesson breach page to see whether it appears in the dataset.
Data from Have I Been Pwned | Sources: BleepingComputer, HIPAA Journal, McKesson’s disclosure notice | Written with AI assistance and checked against these sources on September 25, 2026
Related
- ShinyHunters in 2026: all 49 companies and how they get in
- Am I Breached? Check an address and get alerts
- Data breach directory