McKesson Breach: Leaked Dataset Lists 6.4M Email Addresses

McKesson confirmed unauthorized access and data exfiltration in a cybersecurity incident discovered August 25, 2026. The company said the incident involved certain third-party applications associated with a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units. It has not confirmed ShinyHunters’ claim that it stole 284 million patient records.

The threat actor’s payment deadline is no longer the main development. On September 10, Have I Been Pwned added data attributed to the breach and lists McKesson with 6.4 million affected email addresses. That is a count of addresses in a dataset, not a company-confirmed count of unique people or all records involved. The HIBP breach listing provides the current count.

McKesson’s notice of data breach says potentially affected information may include names, contact details, patient identification numbers, and dates of birth. The company has not announced a complete number of affected individuals. The larger 284 million figure remains an attacker claim; it should not be presented as a verified patient count.

The distinction between the claim and the published dataset is important for people checking possible exposure. An address appearing in Have I Been Pwned indicates the address is in that breach dataset, but does not establish that every associated person received services from McKesson or that all listed medical details are accurate. Conversely, not finding an address does not prove a person’s records were unaffected.

People who may be affected should follow McKesson’s official notification and any instructions from their healthcare provider. Watch for messages that use the incident to solicit passwords, payment, insurance details, or identity documents. Do not rely on a threat-actor leak-site count to determine whether a specific person was notified.

Our initial August 29 report is retained as an unlisted, noindex archive entry; this article consolidates the current confirmed facts and the later dataset development.