CHICAGO, September 10 — Veradigm, the Chicago-based healthcare technology company formerly known as Allscripts Healthcare Solutions, has disclosed a data breach after a cybersecurity incident at one of its third-party vendors exposed patients’ personal data. The company filed the disclosure with the U.S. Securities and Exchange Commission. Under the hood, the mechanism was narrow: an attacker obtained credentials from a vendor’s environment for a Veradigm API reserved for customer services, then used that access to copy patient data.
The stolen data includes personal details and Social Security numbers for some patients. Clinical or medical information remained safe.
What the credentials could — and could not — reach
Veradigm said the vendor’s compromised credentials provided access only through that limited interface. They did not provide access to any other part of its environment, including its broader network, servers, databases, or other systems. That is the detail that matters for anyone trying to size the blast radius.
The incident did not cause operational disruptions, according to the company, but it affected a small number of customers. Veradigm supplies medical practices with electronic health records, e-prescribing, patient-engagement, practice-management, and revenue-cycle software, and its solutions are used by thousands of hospitals, clinics, and biopharmaceutical firms across the United States.
After discovering the breach, Veradigm initiated its incident-response procedures, notified law enforcement, and is investigating to determine the scope. Affected customers and individuals are being notified, with credit-monitoring services offered where applicable.
A claim, and a deadline
Veradigm’s disclosure did not identify the attacker. The Gentlemen ransomware group claimed the intrusion on September 5 and listed the company on its data leak site. The threat actor alleges it is holding 3.5 million patient records that include full names, home addresses, Social Security numbers, email addresses, phone numbers, and personally identifiable information or guarantors.
It threatens to leak the stolen data by Friday, September 11, if the company does not engage in ransom payment negotiation. The Gentlemen emerged around mid-2025 and operates as a double-extortion group, combining data theft with data encryption on Windows, Linux, NAS, BSD, and ESXi systems.
On its data leak site, the gang listed more than 800 victims from 86 countries and various sectors, including manufacturing, technology, healthcare, transportation, and financial services — opportunistic attacks that rely only on access availability. The group’s tooling has drawn scrutiny this year. In April 2026, Check Point reported that it discovered a SystemBC proxy malware botnet with more than 1,500 hosts and linked it to an affiliate of The Gentlemen ransomware gang.
In June 2026, ESET said that The Gentlemen was employing a new endpoint detection and response killer called GentleKiller.
One breach among many
The disclosure lands amid a series of healthcare data breaches. AdaptHealth confirmed 4.1 million people were exposed in a July cyberattack. A breach at medical billing firm MCBS affected 1.26 million people.
A French hospital was fined €500,000 (approximately US$540,000) after a breach exposed data of 727,000 people. Novocure reported a data breach affecting more than 1,400 cancer patients, and Aesto Health said a data breach affected over 9.5 million patients.
Veradigm’s investigation is ongoing. Based on current information, the company does not believe the incident is reasonably likely to materially affect its business, operations, financial condition, or results. The next checkpoint is Friday, when the group’s stated leak deadline falls due — and when the gap between a vendor’s API credentials and 3.5 million alleged patient records will either widen or close.
