INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).
McKesson hit by cyberattack resulting in service degradation issues
| 2026-08-31 12:45 CYBERATTACK (GENERAL)
Executive Summary
AI-generated
A cyberattack on McKesson, a pharmaceutical and healthcare technology company, is causing service issues as of August 31, 2026. The attackers have gained access to an unnamed third-party application and are exfiltrating data, with customers in the oncology and surgical business units being affected. The hackers, attributed to the ShinyHunters cybercriminal group, took credit for the attack on Friday night, threatening McKesson with potential leaks. According to Francisco Fraga, McKesson chief technology officer, the company is not proactively disconnecting systems, which is typically done during ransomware attacks, and instead urging customers to contact them if there are technical issues with services. The incident has resulted in intermittent service degradation for McKesson's customers, who may experience disruptions until the situation is resolved.
Technical Mitigations AI-generated
• Patch the Salesforce environment to prevent data theft and extortion, as hackers linked to ShinyHunters have been demanding substantial ransom payments from companies after stealing data through compromises involving Salesforce environments.
• Monitor for signs of ShinyHunters' tactics, such as unusual login activity or suspicious network traffic, which may indicate a potential attack by the group.
• Implement credit monitoring and identity protection services to protect customers whose data was exfiltrated during the McKesson cyberattack.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Incident Timeline
Tactical Metrics
Intelligence Sources
TheRecord
2026-08-31