McKesson, August 2026: two weeks to connect a leak listing and an 8-K

The evidence that McKesson had been hit was public by the night of August 28. The attacker had listed the company and the company had filed with the SEC. They weren't connected until September 12, fourteen days later, when we made the link by hand.

Convergence was built because of this case. Three things kept the pipeline from seeing it. The filing feed searched only Item 1.05, and McKesson disclosed under 7.01. Vendor reports were read but never stored, so the report that tied McKesson to the campaign's lookalike domain was never a row. And leak listings and filings had no shared key, so there was no way to join them.

2026	What happened	What the pipeline had
late Jul	A campaign starts registering victim-named lookalike domains in a company.claims / company-claims.com pattern.	Nothing. No campaign domain ever reached the IOC store.
08-17	ReliaQuest publishes the advisory that first describes the campaign, with no domains attached.	Nothing. The report collector failed that day and nothing flagged the failure.
08-23	ShinyHunters lists ReliaQuest itself on its leak site.	The listing, as one row among many.
08-25	McKesson discovers a cybersecurity incident, per its later filing.	—
08-28	McKesson files a Form 8-K under Items 7.01 and 9.01, not Item 1.05.	Nothing. The filing feed searched Item 1.05 only.
08-28	ShinyHunters lists McKesson Corporation, 23:57 UTC.	The listing, which the next brief printed in a table between two unrelated victims.
08-29	Leak site and SEC filing name the same organization inside one window.	The correlator, replayed, would have flagged it this morning, on feeds alone.
09-01	Mind ties the breach to a mckesson.claims lookalike and a vishing-to-Okta compromise.	Not in any RSS feed. Added by hand on Oct 23 for this case; on the card it counts as press.
09-10	Flare enumerates 61 domains across 48 brands; MirageSec publishes the vishing playbook.	Both added by hand for this case.
09-12	thrunt.me publishes the kit teardown, and makes the McKesson connection by hand.	Fourteen days after the evidence first lined up.

2026

What happened

What the pipeline had

late Jul

A campaign starts registering victim-named lookalike domains in a company.claims / company-claims.com pattern.

Nothing. No campaign domain ever reached the IOC store.

08-17

ReliaQuest publishes the advisory that first describes the campaign, with no domains attached.

Nothing. The report collector failed that day and nothing flagged the failure.

08-23

ShinyHunters lists ReliaQuest itself on its leak site.

The listing, as one row among many.

08-25

McKesson discovers a cybersecurity incident, per its later filing.

—

08-28

McKesson files a Form 8-K under Items 7.01 and 9.01, not Item 1.05.

Nothing. The filing feed searched Item 1.05 only.

08-28

ShinyHunters lists McKesson Corporation, 23:57 UTC.

The listing, which the next brief printed in a table between two unrelated victims.

08-29

Leak site and SEC filing name the same organization inside one window.

The correlator, replayed, would have flagged it this morning, on feeds alone.

09-01

Mind ties the breach to a mckesson.claims lookalike and a vishing-to-Okta compromise.

Not in any RSS feed. Added by hand on Oct 23 for this case; on the card it counts as press.

09-10

Flare enumerates 61 domains across 48 brands; MirageSec publishes the vishing playbook.

Both added by hand for this case.

09-12

thrunt.me publishes the kit teardown, and makes the McKesson connection by hand.

Fourteen days after the evidence first lined up.

What changed

Filings under any item. 8-Ks are searched by full text for an incident disclosure under 1.05, 7.01 or 8.01. Risk factors, merger warranties and earnings recaps that use the same words are filtered out.
Reports stored whole. Vendor research is fetched, indexed in full text, and its indicators are pulled out. This is where the lookalike domains were: mckesson.claims came from the report text, not from any feed.
One key per organization. “McKesson Corporation” on the leak site and “MCKESSON CORP” on EDGAR now reduce to the same key. Joins are exact, so look-alike names don’t pair up.
Empty runs are flagged. A collector that runs clean but delivers nothing, or one that fails outright as the report collector did on the advisory’s publication day, now shows up in the daily brief.

The card above comes from rerunning the daily query for each past morning, with every signal dated when its source published it. The any-item filing feed and the report store were built after August, so it shows what the correlator would have flagged from these sources, not what it flagged at the time. The leak listing and the 8-K come from feeds. The two reports were added by hand for this case and are marked, and the August 29 match doesn't depend on either.