The attacker never touched Veradigm’s own network. According to the company’s SEC filing, they got hold of credentials from a vendor’s environment, credentials that unlocked a single Veradigm API reserved for customer services, and used them to copy patient data.
The haul includes personal details and Social Security numbers for some patients. Clinical and medical information was not taken, the company says. In the filing’s words, the credentials “provided access only through that limited interface and did not provide access to any other part of the Company’s environment, including the Company’s broader network, servers, databases, or other systems.”
What Veradigm says
The Chicago company, formerly Allscripts Healthcare Solutions, sells electronic health records, e-prescribing, patient-engagement, practice-management and revenue-cycle software to medical practices. Thousands of US hospitals, clinics and biopharmaceutical firms use it. BleepingComputer, which reported the disclosure, relayed the company’s statement that operations were not disrupted and only a small number of customers were affected.
Once it found the breach, Veradigm started incident-response procedures and notified law enforcement. It is still working out the scope. Affected customers and individuals are being told, with credit monitoring offered where applicable. On current information, the company does not expect a material effect on its business or results.
The ransomware claim
The filing does not name an attacker. The Gentlemen ransomware group does. It claimed the intrusion on September 5 and listed Veradigm on its leak site, alleging it holds 3.5 million patient records: names, home addresses, Social Security numbers, email addresses and phone numbers. It has threatened to publish the data by Friday, September 11, unless the company opens ransom negotiations.
The group surfaced around mid-2025 and runs a double-extortion model, stealing data and also encrypting systems across Windows, Linux, NAS, BSD and ESXi. BleepingComputer counted more than 800 victims from 86 countries on its leak site, spanning manufacturing, technology, healthcare, transportation and finance, which suggests opportunistic attacks that depend on whatever access is available.
Check Point reported in April 2026 that it had found a SystemBC proxy botnet of more than 1,500 hosts tied to an affiliate of the gang. In June, ESET said the group was using a new EDR killer called GentleKiller.
