/
← Voltar ao feed
high healthcare pharmaceutical

ShinyHunters extortion campaign leaks McKesson data; 6.4M email addresses added to Have I Been Pwned

1 fonte(s) · 1 atualização(ões) · publicado 10/09/2026 02:45 · coletado há 2 dias

In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign. The group published a substantial corpus of data allegedly taken from the company, including 6.4M unique email addresses alongside other personal and corporate attributes. The data relates to marketing campaign recipients, patients, staff and healthcare provider contacts. Have I Been Pwned added the dataset on 10 Sep 2026 and flagged it as sensitive, so it is not publicly searchable. McKesson's disclosure notice states that it identified unauthorised access to certain third-party applications and exfiltration of data tied to a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units, and that it has reasonable assurance of no ongoing unauthorized activity.

Detalhes técnicos

  • Access was via third-party applications associated with McKesson; the article gives no further detail on the method.
  • Extortion model: "pay or leak" by ShinyHunters, followed by publication of the data.
  • Exposed data: email addresses plus other personal and corporate attributes (6.4M unique emails).
  • Breach occurred in August 2026; added to HIBP on 10 Sep 2026.

Remediação

  • Affected individuals can check exposure through the HIBP dashboard ("Breaches" under "Personal") or search owned domains under "Business".
  • Use a password manager for strong, unique passwords, change reused passwords and enable 2FA wherever supported.
  • Organisations should review third-party application access and be alert to phishing targeting leaked contacts.

Linha do tempo

  1. haveibeenpwned.com ↗ · pub. 10/09/2026 02:45 · coletado 19/10 17:56 primeiro registro

    ShinyHunters extortion campaign leaks McKesson data; 6.4M email addresses added to Have I Been Pwned

    ler a análise desta fonte

    In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign. The group published a substantial corpus of data allegedly taken from the company, including 6.4M unique email addresses alongside other personal and corporate attributes. The data relates to marketing campaign recipients, patients, staff and healthcare provider contacts. Have I Been Pwned added the dataset on 10 Sep 2026 and flagged it as sensitive, so it is not publicly searchable. McKesson's disclosure notice states that it identified unauthorised access to certain third-party applications and exfiltration of data tied to a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units, and that it has reasonable assurance of no ongoing unauthorized activity.

    Technical Details

    • Access was via third-party applications associated with McKesson; the article gives no further detail on the method.
    • Extortion model: "pay or leak" by ShinyHunters, followed by publication of the data.
    • Exposed data: email addresses plus other personal and corporate attributes (6.4M unique emails).
    • Breach occurred in August 2026; added to HIBP on 10 Sep 2026.

    Remediation

    • Affected individuals can check exposure through the HIBP dashboard ("Breaches" under "Personal") or search owned domains under "Business".
    • Use a password manager for strong, unique passwords, change reused passwords and enable 2FA wherever supported.
    • Organisations should review third-party application access and be alert to phishing targeting leaked contacts.