One stolen credential was enough. According to Veradigm’s own filing with the Securities and Exchange Commission, an intruder got hold of API credentials from a third-party vendor’s environment, used them to reach a Veradigm interface meant for customer services, and copied patient data out through it.
Veradigm, a Chicago-based electronic health record and practice management company formerly called Allscripts Healthcare Solutions, disclosed the incident on September 8. It said the attacker only ever touched that one API. Its servers, databases and other systems were not compromised, and operations were unaffected.
What was taken
The stolen data included personal information of patients, and for some of them it may have included Social Security numbers. Veradigm says no clinical or medical information was involved. It is offering affected people free credit monitoring, reported its response procedures were activated once it learned of the problem, and notified law enforcement. The investigation continues, and the company has not said how many people are affected. It described the vendor incident as hitting “a small number” of its customers, who are healthcare provider organizations. That is not much comfort on its own: a few customers can sit on top of a very large number of patients.
Veradigm did not name the attacker. A ransomware and extortion group called The Gentlemen has claimed it. The group listed Veradigm on its dark web leak site on September 5, three days before the filing, saying it holds more than 3.5 million patient records with names, addresses, phone numbers, email addresses and other personal details. BleepingComputer reported that the group also claims data on guarantors, the people financially responsible for a patient’s account, such as a parent or spouse. It threatened to publish everything by September 11 unless Veradigm entered ransom talks. Veradigm has confirmed neither the record count nor the guarantor claim.
A trusted door left unlocked
The method is worth noting. Nobody broke through Veradigm’s perimeter. The credentials came from a vendor’s side, and they worked through an interface Veradigm had authorized, so the requests would have looked legitimate until the credential was shut off. As Paubox noted, an API credential is proof that an application may ask for certain data. Healthcare organizations can limit what each integration can see, rotate credentials and watch for unusual activity.
This is not the company’s first trouble. Veradigm began notifying patients in September 2025 about an earlier breach, in which an attacker used a credential from one of its customers to get into a storage account around December 15, 2024. Veradigm found out on July 1, 2025, when a third party investigating a different incident alerted it. That earlier episode led to a $10.5 million class action settlement that received final court approval in March 2026. Two lawsuits over the new incident, Clay v. Veradigm and Walker v. Veradigm, were filed in federal court in the Northern District of Illinois on September 8 and 9.
Sources
- Veradigm Data Breach
- Veradigm patient data exposed in third-party API breach
- Veradigm Discloses Third Party Data Breach as Hackers Threaten to Publish Data
