Threat Intelligence Brief
Curated summary with source attribution
Source: helpnetsecurity.com
Threat Risk: High
Victim: McKesson
Incident: Unauthorized access to third-party applications resulting in a massive data exfiltration.
Impact: Potential exposure of 284 million records containing PII, PHI, and internal employee data.
Attacker: ShinyHunters
Analysis: The attack highlights a critical vulnerability in identity management, where vishing was used to bypass authentication and compromise Okta SSO accounts. Once inside, attackers pivoted into cloud-based Salesforce and Snowflake environments to exfiltrate a terabyte of sensitive data. This incident underscores the persistent danger of social engineering targeting privileged access in third-party SaaS ecosystems.
Recommendations: Implement phishing-resistant MFA, such as FIDO2 security keys, to prevent SSO account takeovers; Conduct targeted vishing awareness training for employees with high-level administrative access; Audit and apply the principle of least privilege to data access within Salesforce and Snowflake environments
Source: Help Net Security
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-08-31 12:31 UTC
Unauthorized access and exfiltration of data from third-party cloud environments. Potential exposure of 284 million data records containing sensitive PII and medical information. The attackers targeted third-party cloud environments, specifically Snowflake and Salesforce, to exfiltrate nearly a terabyte of sensitive healthcare data. This incident underscores the persistent risk associated with third-party SaaS integrations and the effectiveness of social engineering against high-value targets. The sheer volume of PII and PHI stolen creates a significant long-term risk for the affected individuals.
Corroborating source: hipaajournal.com
Update — 2026-09-02 23:06 UTC
Data theft resulting from a cyberattack involving third-party applications. Unauthorized access and exfiltration of sensitive data. McKesson has acknowledged a data breach stemming from a cyberattack that targeted third-party applications. This incident demonstrates the ongoing risk of supply chain vulnerabilities where trusted external software becomes an entry point for attackers. The breach resulted in the confirmed theft of data, highlighting a failure in third-party risk mitigation.
Corroborating source: healthcaredive.com