Understanding the Threat
Security teams are grappling with the aftermath of McKesson's disclosure of unauthorized access to third-party applications on August 25, 2026. ShinyHunters claims they used vishing attacks to compromise employee Okta accounts, accessing Salesforce and Snowflake environments with around 284 million patient records. This breach has sparked urgent discussions in healthcare IT about social engineering defenses, third-party application security, and the limits of identity controls.
How Attackers Exploited MFA
The attackers didn't bypass the technology; they exploited human error. ShinyHunters used vishing, or voice phishing, to trick McKesson employees into providing credentials or approving authentication requests. They registered domains like mckesson[.]claims to impersonate IT support and create urgency, convincing employees to approve real MFA prompts. This highlights that while MFA protects against credential theft, it doesn't prevent credential donation.
Your defense lies in training your team. Make it clear that IT will never call to request login approvals, share one-time codes, or verify accounts over the phone.
Treating Snowflake and Salesforce as High-Risk
Yes, treat these platforms as high-risk environments. ShinyHunters reportedly exfiltrated about 1TB of data over four days. Salesforce and Snowflake store critical data, including customer records and patient information. Treat them like your production database.
Practical steps include:
- Use phishing-resistant MFA like FIDO2 security keys
- Implement session timeouts under 12 hours
- Enable audit logging and monitor for unusual data exports
- Restrict data export permissions to specific roles
- Set alerts for new OAuth app integrations or data-sharing changes
If an attacker gains access, they shouldn't export large data volumes without triggering alerts.
Your Liability with Third-Party Apps
Even when a processor is breached, you're still the data controller under GDPR and most state privacy laws. McKesson's incident involved third-party applications, and if you're a healthcare provider using their services, you may have notification obligations under HIPAA's Breach Notification Rule.
HIPAA requires business associates to notify you within 60 days of a breach. You then have 60 days to notify affected individuals. Your vendor contracts should specify:
- Notification timelines shorter than regulatory minimums
- Detailed breach reporting requirements
- Audit rights to verify security controls
- Liability allocation for penalties and notification costs
If the data types involved meet the threshold for unsecured protected health information, notification requirements are triggered.
Blocking Impersonation Attacks
The .claims domain is legitimate, making it hard to block outright. ShinyHunters used it to impersonate McKesson's IT team. Instead of relying on domain blocking, implement these controls:
Technical controls:
- Flag external emails with your company name in the sender domain
- Implement DMARC with a reject policy to prevent spoofing
- Use DNS filtering to block newly registered domains
Process controls:
- Establish a verification protocol for IT-related calls
- Create a code word system for IT outreach
- Require IT support requests to originate from your ticketing system
Training:
- Run quarterly vishing simulations
- Teach employees that IT won't request one-time codes or login approvals over the phone
- Encourage reporting of suspected vishing attempts
Health-ISAC has warned about increasing ShinyHunters attacks using these techniques. Your team needs to be familiar with this threat actor's methods.
Detecting Breaches Faster
Four days of undetected exfiltration indicates monitoring gaps. Start with your SaaS platforms:
- Enable Salesforce Event Monitoring for API calls and data exports
- Configure Snowflake to alert on large queries outside business hours
- Set alerts for data export volumes exceeding baseline thresholds
Look for indicators like:
- Logins from new locations followed by bulk data queries
- API calls using new service accounts
- Large queries across multiple tables quickly
- Data exports to unapproved locations
Integrate SaaS audit logs into your SIEM. Monitor these platforms closely; you own the data and the monitoring.
If using Okta, enable ThreatInsight to block suspicious authentication attempts. Review Okta System Logs daily for unusual patterns.
Concerns About Other ShinyHunters Targets
Yes, be concerned. Health-ISAC's warning identified attacks on multiple healthcare tech companies. This isn't a one-off; it's a systematic attack on the healthcare sector's tech supply chain. If you're using services from these vendors, request their security incident reports and ensure they've implemented the discussed controls.
Review vendor risk assessments for any provider that:
- Stores patient data in cloud warehouses
- Uses Okta or similar SSO platforms
- Provides support via phone
- Integrates with your EHR or claims systems
Ask vendors about their MFA requirements, detection thresholds, notification timelines, and vishing defenses. If they can't provide specific answers, escalate them on your risk register.
Next Steps
Request Health-ISAC's ShinyHunters threat advisory if you're a member. Review the NIST Cybersecurity Framework for monitoring controls and document any gaps. For vishing defense training, consider the SANS Security Awareness program. If you're a McKesson customer, monitor their cybersecurity page for updates and check your notification obligations under state laws.
