McKesson Breach: ShinyHunters Stole 284M Records via Okta

ShinyHunters breached one of America’s largest healthcare companies with a phone call. Not a zero-day. Not a supply-chain exploit. A phone call — and the employee picked up. Within four days, the extortion group had walked out with one terabyte of patient data covering 284 million records, including Social Security numbers, oncology treatment histories, medication lists, and Medicaid IDs. McKesson, the $403 billion pharmaceutical distributor that supplies drugs to hospitals and pharmacies across North America, confirmed the incident on August 31. The ransom demand: $55,236,150. McKesson never answered.

How a Phone Call Became a $55M Breach

The attack followed a now-documented ShinyHunters playbook. First, the group registered mckesson.claims — a lookalike domain impersonating McKesson’s IT helpdesk. Then they called employees, manufactured urgency around security compliance or account lockouts, and directed victims to a cloned Okta sign-in page. As employees typed their credentials and MFA codes, ShinyHunters captured them in real time using an adversary-in-the-middle technique and relayed them to Okta before the codes expired. One authenticated session gave the attacker everything that employee could reach: Salesforce, Snowflake, patient databases going back years.

The data extraction ran from August 21 through August 25. When McKesson detected the intrusion on August 25, the damage was already done. The stolen records cover patients from McKesson’s oncology, multispecialty, and medical-surgical business units — some of the most sensitive patient populations in the healthcare system.

The ReliaQuest Warning Nobody Heeded

Here is the uncomfortable part: none of this was a secret. On August 17 — five days before ShinyHunters attacked them directly — ReliaQuest published a public warning about this exact campaign. The cybersecurity firm had identified ShinyHunters registering .claims domains containing company names and using them to impersonate IT helpdesks. On August 22, ShinyHunters used reliaquest.claims against ReliaQuest itself.

The difference in outcomes was stark. At ReliaQuest, an attacker briefly viewed one employee’s identity dashboard and got no further. At McKesson, they exfiltrated a terabyte of protected health information across multiple cloud platforms. What separated them was not awareness — ReliaQuest had written the warning. What separated them was having phishing-resistant authentication already deployed before the call came.

Your MFA Is Probably Not Phishing-Resistant

This is the point most security coverage buries. Push notifications, TOTP codes, and SMS are all interceptable by adversary-in-the-middle attacks. The attacker’s phishing page captures your MFA code the moment you type it and submits it to the real server before it expires. Number matching helps but does not stop a caller who knows what they are doing. According to the Blue Report 2026, once attackers are using valid credentials, only 37% of threat actions are blocked.

FIDO2 and WebAuthn work differently. The cryptographic challenge-response is bound to the legitimate server’s exact domain. A fake sign-in page at mckesson.claims cannot complete the handshake that only mckesson.okta.com can initiate. The hardware key or platform authenticator refuses. There is no code to intercept because there is no code — only a cryptographic proof that the real server can verify. Okta’s phishing-resistant authenticator enforcement and FastPass operate on the same principle.

What Developers and Security Teams Must Do Now

If your organization uses Okta, Salesforce, or Snowflake — and if push-based MFA is your last line of defense — this breach is a direct warning. McKesson’s situation is not an edge case. ShinyHunters has run this playbook against 160-plus organizations since 2024, and healthcare is now their primary target.

• Enable phishing-resistant MFA immediately for all accounts with access to cloud data platforms — Okta FastPass, FIDO2 hardware keys, or passkeys with device binding. Prioritize administrators and anyone with Snowflake or Salesforce access.
• Enforce Okta authentication policies that require phishing-resistant authenticators for high-value applications. Block legacy authentication protocols that bypass modern MFA entirely.
• Implement IT helpdesk callback verification. Any request to reset credentials, approve a new device, or reissue access should trigger a callback to a published, verified number — not the number on the incoming call.
• Audit Snowflake and Salesforce permissions. Least privilege is not optional when one compromised SSO session inherits everything the user can see. No service account needs warehouse-wide read access.
• Monitor for .claims domain registrations containing your company name or abbreviation. This is an active ShinyHunters pre-attack indicator — register defensive variants before they do.

The McKesson breach is not about healthcare security specifically. It is about what happens when SSO convenience meets push-based MFA in an environment where the help desk picks up the phone. Every organization running this configuration is one well-timed call away from the same outcome. The fix exists — phishing-resistant authentication is deployable today. The question is whether your team enables it before or after the call.