McKesson
SourceHave I Been Pwned
StatusConfirmed breach
AddedSeptember 10, 2026
OccurredAugust 21, 2026
Accounts affected6,404,340
Domainmckesson.com
What was exposed
Dates of birthEmail addressesEmployersGendersNamesPersonal health dataPhone numbersPhysical addresses
What to do if you were affected
- Expect more phishing and spam at this address. Treat messages that reference this company with extra caution.
- Watch for text-message phishing and SIM-swap attempts on your phone number.
- Be wary of targeted scams that use your personal details to sound convincing.
Worried your data is exposed?Take back control of your personal data with Literal.
Protect your data Details
In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign . The group subsequently published a substantial corpus of data they alleged was sourced from the company, which included 6.4M unique email addresses among other personal and corporate data attributes. The impacted data related to a range of individuals and roles, including marketing campaign recipients, patients, staff and healthcare provider contacts. In McKesson's disclosure notice , the company advised it had identified unauthorised access to "certain third-party applications and the exfiltration of certain data was associated with a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units", but had "reasonable assurance of no ongoing unauthorized activity".
Frequently asked questions
What is the McKesson data breach?
In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign . The group subsequently published a substantial corpus of data they alleged was sourced from the company, which included 6.4M...
When did the data breach happen?
This data breach occurred around August 2026.
How many accounts were affected?
Around 6,404,340 accounts were affected.
What information was exposed?
Exposed data included Dates of birth, Email addresses, Employers, Genders, Names, Personal health data, Phone numbers and Physical addresses.
What should I do if I was affected?
Expect more phishing and spam at this address. Treat messages that reference this company with extra caution. Watch for text-message phishing and SIM-swap attempts on your phone number. Be wary of targeted scams that use your personal details to sound convincing.
Related breaches