[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgl04KN-lRDI66dycduVBEhdSP4quEX0TpCcBIUPJTVY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":27,"status":28,"created_at":29,"published_at":30,"article":31,"tags":35,"podcasts":54,"controls":61},"b368e5f7-1e46-4183-89f9-cc975542cbc1","vishing-attack-compromises-okta-accounts-exposing-284m-patient-records-at-mckesson","7b68fb45-cc1f-4eff-9218-c13280285811","Vishing Attack Compromises Okta Accounts, Exposing 284M Patient Records at McKesson","The McKesson breach illustrates how social engineering — specifically vishing (voice phishing) — can bypass even enterprise-grade identity platforms like Okta, granting attackers a foothold into interconnected SaaS environments such as Salesforce and Snowflake. This attack demonstrates the cascading risk of third-party application dependencies: a single compromised identity became the key to unlocking vast repositories of sensitive patient data. The healthcare sector is a high-value target due to the richness of patient records, which command premium prices on criminal markets. This incident underscores that technical controls alone are insufficient when human manipulation can sidestep authentication layers, and that third-party vendor access must be treated as an extension of an organization's own attack surface.","**Immediate actions:**\n- Enforce phishing-resistant MFA (e.g., FIDO2\u002Fhardware security keys) for all identity provider accounts, especially Okta, to neutralize credential theft via vishing.\n- Audit and immediately revoke all unnecessary third-party application access tokens and OAuth permissions connected to Salesforce and Snowflake environments.\n- Activate out-of-band identity verification protocols for any requests involving credential resets or access changes received via phone or voice channel.\n\n**Long-term improvements:**\n- Implement Zero Trust architecture principles to ensure that even authenticated Okta sessions require continuous verification before accessing sensitive SaaS platforms.\n- Establish a formal third-party vendor risk management program that includes regular security assessments of all applications with access to patient data.\n- Apply data minimization and role-based access controls within Snowflake and Salesforce so that no single compromised account can access the full data estate.\n\n**Detection measures:**\n- Deploy User and Entity Behavior Analytics (UEBA) to flag anomalous login patterns, unusual data exports, or off-hours access across Okta, Salesforce, and Snowflake.\n- Configure real-time alerting for bulk data queries or large-scale exports from cloud data warehouses to enable rapid incident containment.\n- Conduct regular tabletop exercises simulating vishing and social engineering scenarios targeting help desk and IT staff who handle credential resets.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25,26],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 15 – Service Provider Management","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant MFA)","NIST AC-2 – Account Management","NIST AC-17 – Remote Access","NIST IR-4 – Incident Handling","NIST SA-9 – External Information System Services (Third-Party Risk)","HIPAA § 164.308(a)(5) – Security Awareness and Training","HIPAA § 164.312(d) – Person or Entity Authentication","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of a Personal Data Breach","NIST CSF PR.AC-1 – Identities and Credentials Management","NIST CSF DE.CM-3 – Personnel Activity Monitoring",{},"published","2026-08-29T00:20:27.739084+00:00","2026-08-29T00:20:27.638+00:00",{"id":7,"url":32,"slug":33,"title":34},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmckesson-discloses-breach-after-shinyhunters-claims-patient-data-theft\u002F","mckesson-discloses-breach-after-shinyhunters-claims-patient-data-theft-890fcf","McKesson discloses breach after ShinyHunters claims patient data theft",[36,42,48],{"id":37,"name":38,"slug":39,"description":40,"color":41},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":43,"name":44,"slug":45,"description":46,"color":47},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":49,"name":50,"slug":51,"description":52,"color":53},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[55],{"id":56,"date":57,"edition":58,"title":59,"audio_url":60},"dba25329-5397-4372-abf5-4e824e3c58cd","2026-08-29","morning","ThreatNoir Weekend Brief — August 29","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-29\u002Fthreatnoir-morning-brief-2026-08-29.mp3",[62,66,70],{"slug":63,"name":64,"problem":65},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":67,"name":68,"problem":69},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":71,"name":72,"problem":73},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]