CHICAGO, September 11 — Veradigm, the Chicago-based practice management and electronic health record company formerly known as Allscripts Healthcare Solutions, has disclosed a cybersecurity incident in which a threat actor obtained credentials from a third-party vendor’s environment and used them to copy patient data through one of the company’s application programming interfaces. The disclosure came in a Form 8-K filing with the U.S. Securities and Exchange Commission on September 8, 2026.
Under the hood, the technical reality is narrow but consequential: the intruder held access to a Veradigm API used for customer services, and nothing else. Veradigm said no other parts of its network were compromised, including servers, databases, or other systems.
What was taken — and what was not
The company determined the stolen data included the personal information of patients, which for certain patients may have involved their Social Security numbers. Clinical and medical information was not involved and remained secure, Veradigm said. As a precaution against data misuse, it is offering affected individuals complimentary credit monitoring services.
The investigation is ongoing. Veradigm has yet to publicly disclose how many individuals have been affected, and it said the incident did not impact its operations.
Veradigm did not disclose the name of the threat actor behind the attack, which appears to be a prolific threat group called The Gentlemen. That group added Veradigm to its dark web data leak site on September 5, 2026. The posting alleges that data exfiltrated in the attack includes names, addresses, phone numbers, email addresses, and other personally identifiable information, and that 3.5 million patient records have been obtained.
A threat has been issued to publish the stolen data if the ransom is not paid.
The vendor problem
The HIPAA Journal reported the disclosure on September 10, 2026. As ever, the detail that matters is where the credentials came from. The entry point was not Veradigm’s own perimeter but a third-party vendor’s environment — the supply-chain seam that healthcare technology vendors share with billing, analytics and integration partners.
One set of API credentials, lifted from a vendor, was enough to reach patient records at the customer level. The incident highlights ongoing cybersecurity risks facing healthcare technology vendors and their third-party service providers.
Watch for the affected-individual count, which Veradigm has not yet published, and for any regulatory follow-up now that Social Security numbers are confirmed to be in scope. The Gentlemen’s leak-site posting, meanwhile, remains the only public claim about the volume of records involved.
