The McKesson incident took place between 20 and 25 August 2026
Assessment
McKesson's substitute Notice of Data Breach states: "Our investigation determined that the incident took place between August 20 and August 25, 2026." The discovery date of 25 August is separately stated in the Form 8-K filed on 28 August. The attacker's account, given to BleepingComputer, puts exfiltration between 21 and 25 August, a day narrower than the victim's window, which is consistent with initial access on 20 August preceding bulk export. This is the only element of the timeline on which both sides substantially agree.
Where this claim appeared
McKesson Corporation · 2027-09-08
https://www.mckesson.com/utility/cybersecurity/notice-of-data-breach/What “Verified” means
Established by primary sources — the original disclosure, a vendor incident report, a court filing, a government advisory, or the affected party itself. Where a claim is material, at least two independent sources agree.
5 of 5 · rating scale
Assessed in
McKesson Data Breach: ShinyHunters, One Phone Call, and 284 Million Rows of Patient DataThink this assessment is wrong? Report an error.