McKesson discloses breach after ShinyHunters claims patient data theft

The McKesson breach illustrates how social engineering — specifically vishing (voice phishing) — can bypass even enterprise-grade identity platforms like Okta, granting attackers a foothold into interconnected SaaS environments such as Salesforce and Snowflake. This attack demonstrates the cascading risk of third-party application dependencies: a single compromised identity became the key to unlocking vast repositories of sensitive patient data. The healthcare sector is a high-value target due to the richness of patient records, which command premium prices on criminal markets. This incident underscores that technical controls alone are insufficient when human manipulation can sidestep authentication layers, and that third-party vendor access must be treated as an extension of an organization's own attack surface.