McKesson Breach Investigation: ShinyHunters Claims 284M Records Stolen — Detection and Hardening Guide for Healthcare Defenders

McKesson Corporation — one of the largest pharmaceutical distributors and healthcare services companies in North America, touching roughly one-third of all prescription drugs in the United States — has confirmed it is investigating a cybersecurity incident after the extortion group ShinyHunters publicly claimed to have stolen approximately 284 million records from the company's systems.

If the claim is accurate, this would rank among the largest healthcare-adjacent data breaches ever disclosed. McKesson's ecosystem includes pharmacy management platforms, specialty pharmacy operations, patient support programs, and distribution logistics data. That means the potential blast radius covers protected health information (PHI), personally identifiable information (PII), prescriber data, insurance details, and supply-chain intelligence — a dataset with enormous value for fraud, identity theft, targeted phishing, and secondary extortion.

For defenders, the operational reality is this: ShinyHunters is not a smash-and-grab ransomware crew. They specialize in large-scale data theft and extortion, frequently gaining initial access through stolen or reused credentials, abused SaaS and cloud data platforms, compromised SSO/OAuth integrations, and third-party service providers. Their historical campaigns (including the 2024–2025 waves of attacks against organizations via cloud data warehousing and CRM platforms) demonstrate a consistent playbook: authenticate with legitimate credentials, enumerate, bulk-extract, exfiltrate quietly, then extort.

Whether or not your organization is a McKesson business associate, this incident demands action. Healthcare entities connected to McKesson through EDI feeds, patient assistance programs, or pharmacy networks should assume potential downstream exposure, and every healthcare SOC should treat this as a live-fire rehearsal for their own bulk data theft detection posture.

Technical Analysis

What We Know

• Victim: McKesson Corporation (Fortune 10 healthcare distributor and services provider)
• Threat actor: ShinyHunters — a financially motivated extortion group with a multi-year track record of high-volume data theft, credential-based intrusions, and public leak-site extortion
• Claimed data volume: ~284 million records
• Status: McKesson has acknowledged an investigation; the full scope, affected systems, and data categories have not been officially confirmed at time of writing
• CVE status: No CVE has been publicly associated with this incident. The access vector has not been officially disclosed.

The ShinyHunters Playbook (Defender's View)

Based on the group's documented tradecraft across prior campaigns, healthcare defenders should model their hunt around the following attack chain:

1. Initial access via valid credentials (MITRE ATT&CK T1078). ShinyHunters campaigns have repeatedly leveraged credentials harvested from infostealer logs, prior third-party breaches, and phishing — particularly targeting SaaS tenants, cloud data platforms, and accounts lacking MFA or enrolled in weaker MFA factors.
2. Discovery and enumeration (T1087, T1526). Once inside, operators enumerate accessible databases, CRM objects, file shares, and storage buckets to identify high-value data.
3. Bulk collection (T1530, T1213). Large-scale export via legitimate platform features: mass report exports, SOQL/API query batches against CRM tenants, SELECT * dumps against cloud warehouses, or mass object downloads from cloud storage.
4. Exfiltration (T1567.002). Data staged and moved to attacker-controlled cloud storage (MEGA, file.io, personal cloud tenants) over standard HTTPS — deliberately blending with legitimate traffic.
5. Extortion (T1657). Public leak-site posting and direct negotiation, often weeks after the actual exfiltration occurred.

The critical defensive insight: most of this activity uses legitimate tools and legitimate protocols. Traditional malware-centric detections will see nothing. Detection has to be behavioral — focused on anomalous authentication, anomalous data access volume, and anomalous egress.

Exploitation Status

No exploit is involved in the traditional sense — this is a data theft/extortion incident, not a vulnerability exploitation event. The breach claim is active and under investigation as of publication. Organizations should monitor McKesson's official disclosures, HHS OCR breach portal listings, and regulatory filings for confirmed scope.

Detection & Response

The detections below target the behaviors consistent with ShinyHunters-style bulk data theft. Tune thresholds to your environment's baseline — the goal is to surface anomalous volume and novel destinations, not to fire on routine reporting jobs.

Sigma Rules

---
title: Anomalous Bulk Data Export from SaaS or Database Platforms
id: 3f7a2c91-4b8e-4d2a-9c51-7e6b5a4d3f21
status: experimental
description: Detects abnormally high-volume data export or query activity against SaaS platforms, CRM tenants, or databases, consistent with ShinyHunters-style bulk collection prior to exfiltration.
references:
  - https://attack.mitre.org/techniques/T1530/
  - https://attack.mitre.org/techniques/T1213/
  - https://www.infosecurity-magazine.com/news/healthcare-mckesson-investigates/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1530
  - attack.t1213
logsource:
  category: application
  product: salesforce
  service: api
detection:
  selection:
    Operation|contains:
      - 'ReportExport'
      - 'ApiQuery'
      - 'BulkApi'
      - 'DataExport'
    RowsProcessed|gt: 100000
falsepositives:
  - Scheduled nightly ETL and data warehouse sync jobs
  - Legitimate reporting platforms (Tableau, Power BI service accounts)
level: high
---
title: Cloud Storage Mass Object Download by Single Identity
id: 8b4e1d63-2a7f-4c5b-b3e9-1f8d6c2a5e47
status: experimental
description: Detects a single identity downloading or listing an abnormally large number of objects from cloud storage buckets in a short window, consistent with pre-extortion bulk data theft.
references:
  - https://attack.mitre.org/techniques/T1530/
  - https://www.infosecurity-magazine.com/news/healthcare-mckesson-investigates/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1530
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: 's3.amazonaws.com'
    eventName:
      - 'GetObject'
      - 'ListObjectsV2'
  timeframe: 15m
  condition: selection | count() by userIdentity.arn > 500
falsepositives:
  - Backup and archival automation
  - Data lake ingestion pipelines
level: high
---
title: Authentication from Infostealer-Associated or Impossible-Travel Sources to Sensitive SaaS
id: 2c9d5f84-6e3a-4b71-a8d2-9f4c7b1e6a53
status: experimental
description: Detects successful SaaS/SSO authentication events with impossible travel or from anonymizing infrastructure followed by data access activity — a common precursor in ShinyHunters credential-based intrusions.
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://www.infosecurity-magazine.com/news/healthcare-mckesson-investigates/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1078
logsource:
  category: authentication
  product: azure
detection:
  selection:
    ResultType: 0
    RiskLevelDuringSignIn:
      - 'high'
      - 'medium'
  filter_known:
    Location|contains:
      - 'US'
  condition: selection and not filter_known
falsepositives:
  - Traveling executives on unfamiliar networks
  - VPN egress in unlisted regions
level: medium

KQL Hunt — Microsoft Sentinel / Defender

This query hunts for identities performing high-volume data access or export operations across SaaS/cloud audit logs, joined against risky sign-in context — the strongest combined signal for credential-based bulk theft.

// Hunt: High-volume data access correlated with risky authentication
// Requires: SigninLogs, AuditLog (Entra), CloudAppEvents, and AWS/O365 connectors as applicable
let Lookback = 14d;
let RiskySignins = SigninLogs
    | where TimeGenerated >= ago(Lookback)
    | where ResultType == 0
    | where RiskLevelDuringSignIn in ("high", "medium") or RiskEventTypes_V2 has "unfamiliarFeatures"
    | summarize FirstRisky = min(TimeGenerated), RiskLevels = make_set(RiskLevelDuringSignIn)
        by UserPrincipalName, IPAddress;
CloudAppEvents
| where TimeGenerated >= ago(Lookback)
| where ActionType has_any ("FileDownloaded", "FileSyncDownloadedFull", "ExportReport", "QueryExecuted")
    or Application in ("Salesforce", "Snowflake", "Amazon S3")
| summarize AccessCount = count(), FirstAccess = min(TimeGenerated), LastAccess = max(TimeGenerated),
    DistinctObjects = dcount(ObjectId), Apps = make_set(Application)
    by AccountUpn = tostring(RawEventData.UserId), bin(TimeGenerated, 1h)
| where AccessCount > 200 or DistinctObjects > 100   // tune to baseline
| join kind=inner (RiskySignins) on $left.AccountUpn == $right.UserPrincipalName
| project AccountUpn, IPAddress, RiskLevels, AccessCount, DistinctObjects, Apps, FirstAccess, LastAccess
| order by AccessCount desc;

A secondary hunt for egress to known consumer file-sharing and exfiltration-friendly destinations:

// Hunt: Egress to exfiltration-friendly file sharing / anonymous storage
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where RemoteUrl has_any ("mega.nz", "mega.co.nz", "file.io", "wetransfer.com", "transfer.sh",
    "gofile.io", "pixeldrain.com", "anonfiles", "sendspace.com", "temp.sh")
| summarize Connections = count(), Devices = make_set(DeviceName), FirstSeen = min(TimeGenerated)
    by RemoteUrl, InitiatingProcessAccountName, InitiatingProcessFileName
| order by Connections desc;

Velociraptor VQL — Endpoint Hunt

Use this artifact to hunt endpoints for processes staging large archives or making connections to consumer cloud storage — typical last-mile behavior before exfiltration in extortion intrusions.

-- Hunt for archive staging and exfiltration-destination connections on endpoints
LET proc_hunt = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(7z|winrar|rar\.exe|tar\.exe).*(a |u |-mx|\.zip|\.7z|\.rar)'
   OR CommandLine =~ '(?i)(rclone|megacmd|aws s3 cp|azcopy).*(sync|copy|move|upload)'

LET net_hunt = SELECT Pid, Name, Path, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE RemoteAddress =~ '.*'
  AND (Path =~ '(?i)(rclone|megacmd|7z|winrar)' OR RemotePort in (443))
  AND Name =~ '(?i)(rclone|megacmd)'

SELECT * FROM proc_hunt
UNION ALL
SELECT Pid, Name, Path AS CommandLine, RemoteAddress AS Exe,
       RemotePort AS Username, Status AS CreateTime
FROM net_hunt

Remediation & Verification Script

The following PowerShell script helps healthcare IT and security teams audit high-risk conditions frequently exploited in credential-based SaaS data theft: MFA coverage gaps, legacy authentication, and privileged/service accounts with stale sign-ins.

# ShinyHunters-Style Intrusion Readiness Audit (Entra ID / M365)
# Requires: Microsoft.Graph module, Global Reader or higher
# Run in an elevated session with Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All","Policy.Read.All"

Import-Module Microsoft.Graph.Reports, Microsoft.Graph.Identity.SignIns

Write-Host "=== 1. Accounts with sign-ins but no MFA registration ===" -ForegroundColor Cyan
$users = Get-MgReportAuthenticationMethodUserRegistrationDetail -All
$noMfa = $users | Where-Object { $_.IsMfaRegistered -eq $false -and $_.UserType -eq 'Member' }
$noMfa | Select-Object UserPrincipalName, UserDisplayName | Format-Table -AutoSize
Write-Host "Total non-MFA-registered member accounts: $($noMfa.Count)" -ForegroundColor Yellow

Write-Host "=== 2. Legacy authentication sign-ins in last 7 days ===" -ForegroundColor Cyan
$startDate = (Get-Date).AddDays(-7).ToString('yyyy-MM-ddTHH:mm:ssZ')
$legacy = Get-MgAuditLogSignIn -All -Filter "createdDateTime ge $startDate and clientAppUsed ne 'Browser' and clientAppUsed ne 'Mobile Apps and Desktop clients' and status/errorCode eq 0"
$legacy | Select-Object UserPrincipalName, ClientAppUsed, IpAddress, CreatedDateTime | Sort-Object CreatedDateTime -Descending | Format-Table -AutoSize

Write-Host "=== 3. Privileged-role members without recent sign-in review ===" -ForegroundColor Cyan
$roles = Get-MgDirectoryRole -All | Where-Object { $_.DisplayName -match 'Global Admin|Privileged' }
foreach ($role in $roles) {
    $members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id -All
    Write-Host "$($role.DisplayName): $($members.Count) member(s)" -ForegroundColor Yellow
}

Write-Host "=== 4. Risky sign-ins (last 14 days) ===" -ForegroundColor Cyan
$riskStart = (Get-Date).AddDays(-14).ToString('yyyy-MM-ddTHH:mm:ssZ')
$risky = Get-MgAuditLogSignIn -All -Filter "createdDateTime ge $riskStart and (riskLevelDuringSignIn eq 'high' or riskLevelDuringSignIn eq 'medium') and status/errorCode eq 0"
$risky | Select-Object UserPrincipalName, IpAddress, Location, RiskLevelDuringSignIn, AppDisplayName | Format-Table -AutoSize

Write-Host "`nAction: Disable legacy auth via Conditional Access, enforce phishing-resistant MFA (FIDO2/cert) for all users, and investigate any risky sign-ins touching data platforms." -ForegroundColor Green

Remediation

Because no CVE or specific exploited product has been disclosed, remediation is architectural and identity-centric. Prioritize the following:

1. Enforce phishing-resistant MFA everywhere — no exceptions for service accounts or executives. ShinyHunters' access model depends on credential validity. FIDO2 security keys or certificate-based authentication neutralize replayed passwords and infostealer-harvested credentials. Audit and eliminate SMS/voice factors for privileged and data-platform accounts.

2. Kill legacy authentication. Block IMAP, POP3, SMTP AUTH, and other legacy protocols tenant-wide via Conditional Access. Legacy auth bypasses MFA and remains the most reliable credential-stuffing vector.

3. Baseline and alert on data access volume. Implement thresholds for report exports, bulk API queries, and storage object downloads across CRM, data warehouse, and cloud storage platforms. A single identity exporting hundreds of thousands of rows outside of a scheduled job window is a pageable event, not a log line.

4. Restrict and monitor egress. Egress-filter or CASB-control consumer file-sharing and anonymous storage services (MEGA, file.io, transfer services). Alert on any endpoint or service principal transferring significant volume to unsanctioned destinations.

5. Rotate and scope credentials for third-party integrations. Audit every OAuth grant, API token, and service account with access to PHI-bearing systems. Enforce least-privilege scopes and short token lifetimes. Review all vendor/EDI connections into your environment — if you are a McKesson business associate, validate which data flows exist and what contractual breach-notification obligations apply under your BAAs.

6. Prepare for extortion, not just encryption. Update your IR playbooks for pure data-theft extortion: legal counsel engagement, leak-site monitoring, dark-web credential monitoring for your domain, and a pre-drafted patient/customer notification path that satisfies HIPAA breach notification (60-day HHS/individual notification requirements for 500+ record breaches) and state laws.

7. Monitor for secondary targeting. If McKesson data is confirmed leaked, expect credential-stuffing and highly credible phishing against employees and patients using stolen records. Increase help-desk verification rigor for password resets and brief staff on breach-themed lures.

8. Track official disclosures. Follow McKesson's investor and regulatory filings, the HHS OCR breach portal, and state AG notifications for confirmed scope. Do not wait for the final number to act — identity hardening and data-access monitoring deliver value regardless of how this specific incident resolves.

The lesson from every ShinyHunters incident is the same: the perimeter is the identity, and the kill chain is quiet until the extortion email arrives. Defenders who can see anomalous authentication and anomalous data volume — and who have rehearsed an extortion-only response — are the ones who detect these intrusions in days rather than learning about them from a leak site.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub