Hackers claim millions of patient records stolen during data breach at healthcare giant McKesson
- ID
- 19906
- Status
- summarized
- Published
- 01 Sep 2026, 2:10 AM
- Fetched
- 01 Sep 2026, 2:43 AM
- Provider
- TechCrunch
- Category
- technology
- Original URL
- https://techcrunch.com/2026/08/31/hackers-claim-millions-of-patient-records-stolen-during-data-breach-at-healthcare-giant-mckesson/
- Source URL
- https://techcrunch.com/feed/
Summary
- Score
- 4.5
- Created
- 01 Sep 2026, 2:44 AM
- Tags
- Audience
- developerssaas_founders
What happened
ShinyHunters claims to have stolen millions of patient records from U.S. pharmaceutical distributor McKesson by phishing employees into granting network access, then exfiltrating data from the company's cloud-hosted Snowflake and Salesforce environments. McKesson's CTO Francisco Fraga confirmed the breach affects its oncology & multispecialty and medical-surgical units, and the hackers are demanding a $55 million ransom. Stolen data includes names, addresses, Social Security numbers, diagnoses, medications, allergies, and employee home addresses.
Why it matters
If you ship on Snowflake or Salesforce cloud environments, this is a concrete reminder that your data warehouse perimeter is only as strong as your least-phished employee's session. The attack vector here wasn't a zero-day or misconfigured bucket—it was social engineering leading to cloud account takeover. Review whether your cloud data platform access requires MFA beyond a single SSO password, and whether service accounts with broad read access to production data warehouses can be reached via compromised employee credentials.
Discussion angle
The breach path was phishing → employee credential → cloud data warehouse exfiltration, not a software vulnerability. What's the minimum viable access control layer (MFA, short-lived tokens, row-level security) that would have stopped or limited this on Snowflake specifically?