ShinyHunters demanded $55,236,150 from McKesson with a 72-hour deadline
Assessment
The figure and deadline come from ShinyHunters, which also says McKesson did not respond. McKesson has not acknowledged receiving a demand in its 8-K, its customer notices, or its 8 September Notice of Data Breach. The 72-hour deadline matches the pattern Google documented for the UNC6240 extortion cluster in 2025, which lends the claim plausibility but not confirmation. As of 11 September 2026 no data has been published and no leak-site listing has been reported, so the demand cannot be inferred from a consequence either.
Where this claim appeared
BleepingComputer · 2026-08-28
https://www.bleepingcomputer.com/news/security/mckesson-discloses-breach-after-shinyhunters-claims-patient-data-theft/What “Unverified” means
Widely repeated, but no supporting evidence was located. This is not a statement that the claim is false — it is a statement that nothing published supports it, which is a different and more common problem.
2 of 5 · rating scale
Assessed in
McKesson Data Breach: ShinyHunters, One Phone Call, and 284 Million Rows of Patient DataThink this assessment is wrong? Report an error.