[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmNZmy1OWdtWXgaSLPQ2gEa_tiRZtyeHyubeGUoZkzOI":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"7b68fb45-cc1f-4eff-9218-c13280285811","McKesson discloses breach after ShinyHunters claims patient data theft","mckesson-discloses-breach-after-shinyhunters-claims-patient-data-theft-890fcf","Healthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming it stole 284 million patient data records. [...]","Healthcare giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft. The ShinyHunters extortion group claims to have stolen 284 million patient data records, reportedly obtained through vishing attacks that compromised Okta accounts and led to access of Salesforce and Snowflake environments. McKesson is investigating the incident, which may cause intermittent service degradation for customers.","McKesson discloses data breach after ShinyHunters claims theft of 284M patient records.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmckesson-discloses-breach-after-shinyhunters-claims-patient-data-theft\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F08\u002F28\u002Fmckesson.jpg","2026-08-28T22:40:17+00:00","2026-08-29T00:00:09.278456+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"McKesson","vendor",{"name":21,"type":22},"ShinyHunters","threat_actor",{"name":24,"type":25},"Okta","product",{"name":27,"type":25},"Salesforce",{"name":29,"type":25},"Snowflake","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":30,"icon":32,"name":33,"slug":34},null,"Breaches","breaches",[36,38,43,48],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":55,"value":56,"context":57},"domain","mckesson[.]claims","Domain used by ShinyHunters for vishing attacks impersonating McKesson's help desk.",[18,24,27],{"controls":60,"vendors":144},[61,89,115],{"slug":62,"name":63,"problem":64,"products":65},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":83,"vendor_name":24,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":90,"name":91,"problem":92,"products":93},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":83,"vendor_name":24,"vendor_logo":84,"product_slug":111,"product_name":112,"url":113,"description":114},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":116,"name":117,"problem":118,"products":119},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":165},"vishing-attack-compromises-okta-accounts-exposing-284m-patient-records-at-mckesson","Vishing Attack Compromises Okta Accounts, Exposing 284M Patient Records at McKesson","The McKesson breach illustrates how social engineering — specifically vishing (voice phishing) — can bypass even enterprise-grade identity platforms like Okta, granting attackers a foothold into interconnected SaaS environments such as Salesforce and Snowflake. This attack demonstrates the cascading risk of third-party application dependencies: a single compromised identity became the key to unlocking vast repositories of sensitive patient data. The healthcare sector is a high-value target due to the richness of patient records, which command premium prices on criminal markets. This incident underscores that technical controls alone are insufficient when human manipulation can sidestep authentication layers, and that third-party vendor access must be treated as an extension of an organization's own attack surface.",[150,151,152,153,154,155,156,157,158,159,160,161,162,163,164],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 15 – Service Provider Management","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant MFA)","NIST AC-2 – Account Management","NIST AC-17 – Remote Access","NIST IR-4 – Incident Handling","NIST SA-9 – External Information System Services (Third-Party Risk)","HIPAA § 164.308(a)(5) – Security Awareness and Training","HIPAA § 164.312(d) – Person or Entity Authentication","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of a Personal Data Breach","NIST CSF PR.AC-1 – Identities and Credentials Management","NIST CSF DE.CM-3 – Personnel Activity Monitoring",{}]