No zero-day. No malware. A phone call to a helpdesk — and roughly one terabyte walked out of a healthcare giant.
McKesson has confirmed a data breach. ShinyHunters claims 284 million records and has demanded $55,236,150, with a 72-hour clock that expired around September 1, 2026.
WHAT ACTUALLY HAPPENED
The entry point was vishing — voice phishing aimed at multiple McKesson employees — used to compromise their Okta single sign-on credentials.
From there, exfiltration ran from August 21 to August 25, 2026. Four days. Around one terabyte.
The group claims the data includes names, contact details, Social Security numbers, dates of birth, medical record numbers, Medicaid numbers, medication and allergy information, diagnoses and appointment records.
One honest caveat, and it comes from the attackers themselves: 284 million is a raw record count, not a count of unique individuals. They say they have not analysed the set closely enough to know how many people are actually affected. Expect the confirmed figure to move.
WHY SSO IS BOTH THE FIX AND THE FAILURE
Consolidating identity onto Okta is the right architectural decision. It is also why one convincing phone call reaches everything.
The industry spent a decade hardening the login. Attackers responded by moving one layer out — to the human process that restores access when the login fails. Password resets, MFA re-enrolment, device replacement: that workflow is designed to be helpful under pressure, which is exactly what makes it exploitable.
Note what did not stop this. MFA was almost certainly in place. It does not matter when the attacker persuades someone to enrol a new factor for them.
And the outcome was not encryption. It was theft plus a deadline. There is no restore-from-backup path out of extortion — once the data is gone, your only remaining control is what it costs the attacker to use it.
WHAT TO DO NOW
HARDEN THE HELPDESK, NOT JUST THE LOGIN — require out-of-band verification for every MFA reset and device enrolment, with no exceptions for urgency.
DEPLOY PHISHING-RESISTANT FACTORS — FIDO2 and hardware keys remove the credential the caller is trying to talk their way past.
ALERT ON BULK EXPORT, NOT JUST BULK LOGIN — four days of exfiltration is four days of detectable volume anomalies in your SaaS and data platforms.
REHEARSE THE VISHING SCENARIO — run the call against your own service desk and count how far a confident stranger actually gets.
Your attacker did not break your authentication. They asked someone to open it.
Who at your organisation can reset MFA for an executive — and what stops a phone call from convincing them?