Veradigm: vendor credentials used to download patient data
An unauthorised party used credentials from a third-party vendor to download patient personal data through a limited application interface.
What happened
Veradigm said in a filing with the U.S. Securities and Exchange Commission that an unauthorised party obtained credentials from one of its third-party vendors and used them through a limited application interface to download copies of patient personal data for a small number of its customers. The filing says access was limited to that interface — not Veradigm's broader network — and caused no operational disruption. A ransomware group calling itself The Gentlemen separately claimed about 3.5 million records; Veradigm has not confirmed that figure.
Who is affected
Patient personal data, including Social Security numbers in some instances. Veradigm says no clinical or medical data was involved, and it has not published how many people are affected.
How serious
Patient personal data was downloaded, including Social Security numbers in some instances — a combination that creates a concrete identity-fraud risk for the patients involved. Veradigm says no clinical or medical data was involved, access was limited to that interface, and there was no operational disruption.
What to do now
If Veradigm or your healthcare provider notifies you, take up the credit monitoring offered where applicable. Our guidance: because Social Security numbers were involved for some patients, consider a free credit freeze and review statements and explanations of benefits for anything unfamiliar.
Source: Veradigm Form 8-K, U.S. Securities and Exchange Commission (September 8, 2026)