McKesson Data Theft Extortion Attack: Defending Healthcare SaaS and Cloud Data Against ShinyHunters-Style Extortion

McKesson, one of the largest healthcare distribution and services vendors in the United States, is managing the fallout from a data theft extortion attack. While the company has not publicly attributed the intrusion, the prolific extortion group ShinyHunters has claimed responsibility. For healthcare defenders, this incident is not an isolated event — it is the latest confirmation of a sustained, sector-wide campaign in which extortion actors prioritize pure data theft and extortion over encryption, exploiting cloud and SaaS control gaps rather than deploying traditional ransomware payloads.

Healthcare organizations sit at the intersection of high-value regulated data (PHI under HIPAA), sprawling third-party integrations, and complex identity infrastructures. ShinyHunters has repeatedly demonstrated that they understand this attack surface better than many of the organizations defending it. If your environment includes Salesforce, Snowflake, or similar SaaS data platforms — and in healthcare, it almost certainly does — this incident should trigger an immediate review of your identity, OAuth, and data egress controls.

Threat Actor Context: ShinyHunters' Evolving Playbook

ShinyHunters has matured from a credential-stuffing and database-leak operation into a sophisticated extortion enterprise. Their recent tradecraft against large enterprises follows a consistent pattern:

Initial access via identity, not malware. Voice phishing (vishing) against help desks and employees, MFA fatigue/push-bombing, adversary-in-the-middle (AiTM) phishing kits, and abuse of stolen session tokens are the group's preferred entry vectors. Notably, this means endpoint detection alone will not catch them — there may be no malicious binary in the environment at all.
Targeting SaaS data stores directly. The group has repeatedly targeted cloud data platforms and CRM ecosystems, using stolen single sign-on (SSO) sessions or abused OAuth tokens to run bulk data exports. Because this access rides on legitimate credentials and legitimate application APIs, it frequently bypasses perimeter controls entirely.
Extortion without encryption. Rather than detonating ransomware, ShinyHunters exfiltrates data and applies pressure through leak threats, direct victim contact, and public claims — exactly the model now playing out with McKesson. This deprives defenders of the classic ransomware tripwires (mass file modification, shadow copy deletion) and makes data egress monitoring the primary detection surface.

Affected Scope and Exploitation Status

Victim: McKesson Corporation — a Fortune-level healthcare distributor and technology vendor whose compromise carries supply-chain implications for pharmacies, hospitals, and health systems downstream.
Attack type: Data theft and extortion. No CVE is associated with this campaign; the weakness exploited is identity and SaaS configuration posture, not a software vulnerability.
Exploitation status: Confirmed active, in-the-wild campaign. ShinyHunters' targeting of the healthcare sector is ongoing as of 2026.
Attribution caveat: McKesson has not formally attributed the attack; the ShinyHunters claim is self-reported by the group. Treat claims on extortion leak sites with skepticism but investigate as if the data theft is real until proven otherwise.

The absence of a CVE is the point. There is no patch for this. Defense lives in identity hardening, OAuth governance, and egress detection.

Detection & Response

Because this threat model is identity- and data-plane-driven rather than malware-driven, detections should focus on: (1) anomalous authentication and MFA events, (2) OAuth application abuse against SaaS platforms, and (3) bulk data access and exfiltration patterns.

Sigma Rules

YAML

---
title: MFA Push Flood Followed by Successful Authentication
description: Detects a burst of MFA push notifications to a single user followed by a successful sign-in, consistent with MFA fatigue attacks used by extortion groups such as ShinyHunters to gain initial access to SaaS platforms.
author: Security Arsenal
date: 2026/04/06
references:
  - https://attack.mitre.org/techniques/T1621/
  - https://attack.mitre.org/techniques/T1078/
logsource:
  product: azure
  service: signinlogs
detection:
  selection_mfa_challenge:
    authenticationMethod|contains: 'push'
    status: 'failure'
  selection_success:
    status: 'success'
  condition: selection_mfa_challenge and selection_success
falsepositives:
  - Users re-authenticating after MFA timeouts
level: high
---
title: OAuth Consent Grant to Newly Registered or Unverified Application
id: 3b8f2e71-9c4a-4d12-ae67-8f1c5d9e2b34
status: experimental
description: Detects user or admin consent granted to OAuth applications that are unverified or newly registered, a technique used to maintain persistent access to SaaS data platforms such as Salesforce and Snowflake after initial credential theft.
references:
  - https://attack.mitre.org/techniques/T1550/001/
  - https://attack.mitre.org/techniques/T1528/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1550.001
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName:
      - 'Consent to application'
      - 'Add service principal'
      - 'Add OAuth2PermissionGrant'
    result: 'success'
falsepositives:
  - Approved third-party application onboarding; maintain an allowlist of sanctioned app IDs
level: medium
---
title: Bulk Data Export via SaaS Command Line or API Client
id: 9d41c6a2-5f38-4b7e-91ac-2e7d4f8a1c56
status: experimental
description: Detects execution of Salesforce CLI, Snowflake CLI, or generic API clients used to perform bulk data extraction, consistent with extortion actors exporting CRM or cloud warehouse data after SSO compromise.
references:
  - https://attack.mitre.org/techniques/T1530/
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\sf.exe'
      - '\sfdx.exe'
      - '\snowsql.exe'
      - '\snow.exe'
  selection_cmdline:
    CommandLine|contains:
      - 'data export'
      - 'bulk query'
      - 'COPY INTO'
      - 'data:export'
      - 'sobjects query'
      - '--resultformat csv'
      - '--output-file'
  condition: 1 of selection_*
falsepositives:
  - Legitimate data engineering and ETL workloads; baseline by user and host before tuning
level: high

KQL Hunt Query (Microsoft Sentinel / Defender)

This query hunts for anomalous sign-in patterns consistent with vishing/AiTM compromise followed by high-volume SaaS access. It correlates impossible-travel-style sign-ins with process execution of data extraction tooling on endpoints.

KQL — Microsoft Sentinel / Defender

// Hunt 1: Anomalous sign-ins to SaaS platforms from new geographies/ASNs
let lookback = 14d;
SigninLogs
| where TimeGenerated > ago(lookback)
| where AppDisplayName has_any ("Salesforce", "Snowflake", "Workday", "ServiceNow")
    or ResourceDisplayName has_any ("Salesforce", "Snowflake")
| summarize
    SignInCount = count(),
    Locations = make_set(Location),
    ASNs = make_set(NetworkLocationDetails),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by UserPrincipalName, IPAddress, AppDisplayName
| where SignInCount > 50 or array_length(Locations) > 1
| project UserPrincipalName, IPAddress, AppDisplayName, SignInCount, Locations, FirstSeen, LastSeen
| order by SignInCount desc;
// Hunt 2: Endpoint execution of SaaS data export tooling
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("sf.exe", "sfdx.exe", "snowsql.exe", "snow.exe", "curl.exe", "wget.exe")
   or ProcessCommandLine has_any ("data export", "bulk query", "COPY INTO", "sobjects query")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc;
// Hunt 3: OAuth consent grants in the last 30 days
AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName in ("Consent to application", "Add OAuth2PermissionGrant")
| mv-expand TargetResources
| project TimeGenerated, OperationName, InitiatedBy = tostring(parse_json(InitiatedBy).user.userPrincipalName),
    AppId = tostring(TargetResources.id), Result
| order by TimeGenerated desc

Velociraptor VQL Hunt

Use this artifact to sweep endpoints for evidence of bulk export tooling and recently staged data archives — a common pre-exfiltration artifact when actors pull SaaS exports to an intermediate host before egress.

VQL — Velociraptor

-- Hunt for SaaS export tooling execution and staged data archives
LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(data export|bulk query|COPY INTO|sobjects query|snowsql|sfdx)'
   OR Exe =~ '(?i)(sf\\.exe|sfdx\\.exe|snowsql\\.exe|snow\\.exe)$'

LET archives = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='C:/Users/*/**', accessor='ntfs')
WHERE FullPath =~ '(?i)\\.(zip|7z|rar|tar\\.gz)$'
  AND Size > 100000000
  AND Mtime > now() - 1209600

SELECT * FROM procs
UNION ALL
SELECT NULL AS Pid, 'STAGED_ARCHIVE' AS Name, FullPath AS CommandLine,
       format('%d bytes', args=Size) AS Exe, '' AS Username, Mtime AS CreateTime
FROM archives

Hardening Script (PowerShell)

This script audits Entra ID for risky OAuth consent grants and flags service principals created in the last 30 days — the persistence layer extortion actors rely on after stealing an SSO session. Run it with an account holding AuditLog.Read.All and Application.Read.All Graph permissions.

PowerShell

# Requires: Microsoft.Graph module, Connect-MgGraph -Scopes "AuditLog.Read.All","Application.Read.All","Directory.Read.All"
Connect-MgGraph -Scopes "AuditLog.Read.All","Application.Read.All","Directory.Read.All" -NoWelcome

# 1. List OAuth2 permission grants consented in the last 30 days
$cutoff = (Get-Date).AddDays(-30).ToString("yyyy-MM-ddTHH:mm:ssZ")
$consentEvents = Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $cutoff" -All |
    Where-Object { $_.OperationType -match "Consent" -or $_.ActivityDisplayName -match "Consent to application" }
$consentEvents | Select-Object ActivityDateTime, ActivityDisplayName,
    @{N='InitiatedBy';E={$_.InitiatedBy.User.UserPrincipalName}}, Result |
    Export-Csv -Path .\RecentConsentGrants.csv -NoTypeInformation

# 2. Enumerate service principals created recently and flag unverified publishers
$recentSPs = Get-MgServicePrincipal -All | Where-Object {
    $_.AdditionalProperties.createdDateTime -and
    [datetime]$_.AdditionalProperties.createdDateTime -gt (Get-Date).AddDays(-30)
}
$recentSPs | ForEach-Object {
    $app = Get-MgApplication -Filter "appId eq '$($_.AppId)'" -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        DisplayName     = $_.DisplayName
        AppId           = $_.AppId
        CreatedDateTime = $_.AdditionalProperties.createdDateTime
        VerifiedPublisher = $app.VerifiedPublisher.DisplayName
        PublisherVerified = [bool]$app.VerifiedPublisher.VerifiedPublisherId
    }
} | Export-Csv -Path .\RecentServicePrincipals.csv -NoTypeInformation

# 3. Audit: enforce admin consent workflow — check if user consent is currently allowed
$authPolicy = Get-MgPolicyAuthorizationPolicy
Write-Host "User consent permission classification: $($authPolicy.DefaultUserRolePermissions.AllowedToCreateApps)"
$consentPolicy = Get-MgIdentityConditionalAccessPolicy -ErrorAction SilentlyContinue
Write-Host "Review output CSVs. Any unverified app with user consent in the last 30 days warrants IR triage."

# 4. Recommendation check: confirm risky sign-in policies exist (manual validation required)
$cap = Get-MgIdentityConditionalAccessPolicy -All
$cap | Where-Object { $_.State -eq 'enabled' } |
    Select-Object DisplayName, State |
    Export-Csv -Path .\EnabledCAPolicies.csv -NoTypeInformation
Write-Host "Verify a CA policy enforces phishing-resistant MFA for all users and blocks legacy auth."

Remediation and Defensive Priorities

There is no vendor patch for this campaign. Remediation is architectural. Prioritize the following, in order of defensive impact:

Phishing-resistant MFA, everywhere. Move all users — especially help desk staff, executives, and SaaS administrators — to FIDO2/passkeys or certificate-based authentication. Disable SMS and push-based MFA for privileged SaaS roles. ShinyHunters' vishing tradecraft specifically defeats push MFA and weak help-desk identity verification.
Harden help desk identity verification. The group's initial access frequently begins with a phone call. Enforce callback verification to on-file numbers, manager approval for MFA resets on privileged accounts, and step-up authentication for any credential reset request. Document and rehearse this process — it fails under pressure if it only exists on paper.
Enforce OAuth governance. Disable user consent to unverified applications in Entra ID and equivalent IdP settings; require admin consent workflow for all third-party app grants. Inventory existing OAuth grants to Salesforce, Snowflake, and other data platforms and revoke anything without a documented business owner. Extortion actors use consented apps as durable persistence that survives password resets.
Monitor SaaS data-plane activity, not just sign-ins. Enable and centralize Salesforce Event Monitoring, Snowflake access history, and IdP audit logs into your SIEM. Alert on bulk export API calls, anomalous query volumes, new connected apps, and session reuse from impossible geographies. In a no-encryption extortion model, your data egress telemetry is your last line of detection.
Constrain session token portability. Enforce Conditional Access token protection / continuous access evaluation where available, shorten session lifetimes for SaaS admin roles, and bind sessions to device compliance state. Stolen session cookies are only useful while portable.
Prepare your extortion playbook. Update IR runbooks for data-theft-only scenarios: leak site monitoring, legal/regulatory notification timelines under HIPAA (60-day HHS notification window for breaches affecting 500+ individuals), downstream supply-chain notification obligations given McKesson's position in the pharmaceutical distribution chain, and a pre-approved leadership decision framework for extortion demands.
Third-party exposure review. If your organization is a McKesson customer or receives services through McKesson's platforms, assume potential downstream exposure. Request formal notification of data involvement, review what PHI/PII you have shared with the vendor, and validate your business associate agreements (BAAs) cover breach notification obligations.

The Bottom Line

The McKesson incident underscores what seasoned responders have been telling healthcare CISOs for two years: the sector's most dangerous adversaries are no longer leading with ransomware — they are leading with your own SSO. ShinyHunters succeeds because SaaS identity governance lags endpoint security maturity by years. Close that gap now, instrument your data egress paths, and treat every OAuth grant and help-desk password reset as a potential initial access event.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub