Third-party access can become business access
On August 25, 2026, McKesson discovered an incident affecting its systems. In an update a few days later, the company confirmed unauthorized access to certain third-party applications and the exfiltration of data associated with part of its Oncology & Multispecialty and Medical-Surgical operations.
Because the investigation was still in progress, facts confirmed by McKesson must be separated from claims made publicly by the group that attributed the attack to ShinyHunters. That caution does not reduce the lesson: connected applications can hold data as sensitive as core systems.
The connected-application attack surface
An organization may have a well-protected mailbox while leaving third-party access too broad. A CRM, storage, support, or analytics application may receive a long-lived token, be administered by another team, and remain absent from the current inventory.
The employee account then becomes an indirect key. A compromise through vishing, an unrevoked session, or a forgotten OAuth authorization can open several services without an attacker breaking a password at each step.
A third-party access checklist
- List applications with access to data or email.
- Identify the owner of each integration and the permission it actually needs.
- Remove unused connections and reduce permissions on the rest.
- Require phishing-resistant MFA for sensitive and administrator accounts.
- Verify urgent requests through a second channel, especially by phone.
- Test session, token, and application revocation when an account is compromised.
Passwords and recovery codes should be unique and available to authorized people, but never stored in the application or ticket describing the incident.
The Soclyde connection
Soclyde does not govern third-party permissions. It helps reduce copies and reuse around human accounts: unique passwords, limited sharing, and encrypted local-first storage. That foundation makes rotation more realistic when several accesses must be cut quickly.
Soclyde's passwordless authentication article also explains that MFA and passkeys protect a login step, while teams still need to watch sessions, authorized applications, and recovery processes.
The takeaway
An incident in a third-party application becomes a business incident when identities, permissions, and data are connected without a clear inventory. The right response combines separated access, human verification, and a real ability to revoke what was granted.
