McKesson disclosed a breach tied to unauthorized access of third-party applications and data theft affecting some customers. The ShinyHunters extortion group claims it used phone-based social engineering (vishing) to steal employee credentials, took over Okta single sign-on accounts, and then accessed Salesforce and Snowflake to exfiltrate roughly 1TB of data before demanding a $55M ransom.
According to claims from the ShinyHunters extortion group, the intrusion tied to McKesson began with vishing, or voice-based phishing calls, made directly to employees. The attackers reportedly used these calls to obtain login credentials, which were then used to take over Okta single sign-on accounts. From that foothold, the group claims it moved laterally into Salesforce and Snowflake environments and exfiltrated roughly 1TB of data over four days. McKesson has confirmed unauthorized access to certain third-party applications and data exfiltration affecting a subset of customers in specific business units, though the specific extortion claims, including the reported $55,236,150 ransom demand, have not been independently verified.
Single sign-on systems like Okta are designed to simplify access, but that convenience becomes a liability once credentials are compromised. A single successful vishing call that captures one set of login details can open the door to multiple connected systems at once. This case illustrates why phone-based social engineering targeting helpdesk or support scenarios remains an effective technique: it exploits trust in a human voice rather than relying on a malicious link or attachment that email filters might catch.
These patterns match the pretext described in this incident: a caller posing as IT or SSO support asking employees to confirm login details to avoid being locked out.
Organizations can reduce the risk of this attack path by reinforcing a few core practices. Employees should be trained to treat any unexpected request for credentials over the phone as suspicious, regardless of how legitimate the caller sounds, and to hang up and call back through a verified internal number. IT and IAM teams should require strict verification and escalation steps for any SSO or account-related change, since a single compromised credential can cascade into access across connected platforms like Salesforce and Snowflake. Just as important is a strong reporting culture: employees who suspect they received a social-engineering call should report it immediately so security teams can investigate and contain any potential exposure before it spreads further across the environment.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
ShinyHunters claims initial access came from vishing calls to employees, followed by use of stolen credentials to take over Okta SSO accounts.
The group claims it then accessed McKesson's Salesforce and Snowflake environments and exfiltrated about 1TB of data over four days.
McKesson reported unauthorized access to certain third-party applications and data exfiltration affecting a subset of customers, but the extortion group's specific claims are not independently verified.
Employees should treat unexpected calls requesting passwords or verification details as suspicious and verify the caller through a trusted internal callback method before sharing anything.
A group called ShinyHunters says they breached McKesson with one thing: a fake IT phone call that stole an Okta login. The caller says, “Hi, this is IT support. There’s an issue with your single sign-on, can you confirm your Okta username and password so we don’t have to lock your account?” The moment they shared it, Okta was taken over, then Salesforce and Snowflake, and about a terabyte of data walked out. Here’s the trick: it feels routine, IT, Okta, account lockout, but real support will never ask for your password over the phone. An unsolicited call plus urgency about locking your account is your red flag. If anyone calls about Okta or single sign-on and asks for a password or code, hang up and call your real helpdesk using the number on the intranet, then report the call.
This weekly threat bulletin highlights multiple real-world incidents, including a healthcare data breach claim where attackers reportedly used phone-based social engineering (vishing) to compromise identity accounts and access cloud apps. It also describes a large-scale “debt relief” email phishing…
Boston Scientific and McKesson disclosed separate cyber incidents impacting healthcare operations and sensitive data. Boston Scientific’s ongoing attack disrupted remote monitoring for some implanted cardiac devices, while McKesson confirmed unauthorized access to third-party apps tied to specific…
Brinks Home says it is investigating a cybersecurity incident after the ShinyHunters group claimed it broke in by calling employees and tricking them into approving Microsoft Entra authentication actions. The attacker is threatening to publish data it claims to have stolen, including alleged…
Uber Freight is investigating unauthorized access after the Helix extortion group claimed it stole nearly one million files from company cloud and email repositories. Google-linked research says the broader cluster (UNC6671) commonly gets in by calling employees and posing as IT helpdesk staff…
Google and Reuters report a real vishing-led intrusion campaign tied to the extortion crew behind the retired “BlackFile” brand (tracked as UNC6671). Attackers call employees on personal phones spoofing the corporate IT help desk, push a same-day “passkey/MFA update,” and send them to a look‑alike…
Google says the BlackFile extortion group (UNC6671) rebranded to “Redact” while keeping the same core scam: phone calls that impersonate IT helpdesk staff and push “urgent security migrations.” Victims are directed to spoofed login pages that steal passwords and MFA codes, enabling attackers to…
