Attackers phoned McKesson employees, took over single sign-on accounts and pulled about a terabyte out of Salesforce and Snowflake in four days. No encryption was broken, because none of it was in the way.
McKesson, one of the largest healthcare distributors in the United States, discovered a cybersecurity incident on 25 August 2026 and disclosed it three days later in a Form 8-K filed with the SEC, saying the investigation was in its early stages. The extortion group ShinyHunters claimed the theft, put the volume at roughly one terabyte taken between 21 and 25 August, and demanded $55,236,150 with a 72-hour deadline that the company did not answer, according to BleepingComputer.
McKesson has said the incident appears to involve data relating to a subset of customers of its Oncology & Multispecialty and Medical-Surgical business units, and that it does not believe any action is required by customers, as reported by Help Net Security. The attacker's claims have not been independently verified. The headline figure of 284 million records is a count of database rows, not of unique patients, a distinction the group itself has drawn.
The claimed route in was a telephone. Voice phishing calls to McKesson employees produced credentials for Okta single sign-on accounts, and from there the attackers reached the company's Salesforce and Snowflake environments and exported data over four days. CyberInsider reviewed samples supplied privately by the group and found them consistent with the description of the breach.
No cryptography was defeated anywhere in that chain. The attackers presented valid credentials to systems that were functioning exactly as designed. Both platforms encrypt data at rest and in transit, and neither control was relevant, because a platform that holds the keys decrypts for whoever holds a valid session.
Provider-held encryption defends against a stolen disk, a misrouted backup and a network eavesdropper. It does nothing against an authenticated session, which is the mechanism behind most large data thefts now being disclosed. The claimed field list makes the consequence concrete: names, addresses, dates of birth, Social Security numbers, patient IDs, Medicaid numbers, medical record numbers, medication and allergy information. Those fields sat in a CRM and a data warehouse in a form those systems could read, because reading them is what those systems are for.
Federated identity is sound engineering. It removes password reuse, centralises revocation and makes strong authentication practical across dozens of applications. It also fixes the price of one phished employee. When one identity provider fronts both a customer relationship platform and an analytics warehouse, a single successful call reaches both. The pattern is not new to this victim: the HIPAA Journal notes that the same group has been running voice phishing and social engineering against healthcare organisations for some time, listing Medtronic, Abbott Laboratories, iRhythm, AdaptHealth, DentaQuest and Baxter International among earlier claimed victims.
A stolen session returns whatever the platform can read. The design question is how much that is.
Not everything can be hidden from the system that holds it. A CRM has to render records, a warehouse has to run queries, and a hospital system has to show a clinician a chart. Operational data has to be readable somewhere, and the defences there are the ordinary ones: phishing-resistant authentication, tight scoping of what any one account can export, and alerting on bulk reads.
A large share of what leaves in these incidents is not live operational data. It is files: exports, scans, reports, contracts, imaging, correspondence, attached to a ticket or parked in a shared folder because someone had to send them to someone else. Those files rarely need to be readable by the platform storing them, and when they are, every credential that reaches that platform is also a credential that reaches their contents.
SpaceBox Lite encrypts a file on the sender's device before it is uploaded. The keys are generated on that device and stay there. Each file is sealed with AES-256-GCM, and the key is wrapped using post-quantum ML-KEM-768 key exchange (NIST FIPS 203). Our servers hold ciphertext. A sender needs no account and hands over no personal data, so there is no sender directory to phish and no session that would decrypt anything if it were stolen. Post-quantum key exchange is a published standard, available to anyone who implements it; the part that matters for this story is where the keys sit.
Lite is free, with a 1 MB limit, one sender and three files; a free voucher at beta.i46.space adds 100 MB and 100 files in exchange for an email address. It is not available to EU and EEA residents during the beta. For archives that need to survive an identity compromise outright, the SpaceBox hardware vault is an on-premises, air-gapped, append-only appliance with N-approvals, holding data that no phished login can reach. Why SpaceBox sets out the differences.
McKesson's investigation is early and the numbers will move. The mechanism is already clear, and it is the same one behind a long run of recent disclosures. Attackers took the path that required no cryptanalysis: they called someone, signed in, and read what the systems were able to read.