Healthcare technology company Veradigm has disclosed a data breach following a cybersecurity incident at one of its third-party vendors. The compromise exposed patients' personal data, though the company states that no operational disruptions occurred and only a small number of customers were affected.
Formerly known as Allscripts Healthcare Solutions, Veradigm is based in Chicago and provides electronic health records, e-prescribing, and practice-management software to thousands of hospitals, clinics, and biopharmaceutical firms across the United States.
In a filing with the U.S. Securities and Exchange Commission (SEC), Veradigm explained that an attacker obtained credentials from the vendor’s environment for a Veradigm API reserved for customer services. The threat actor used this access to copy patient data. The stolen information includes personal details and Social Security numbers (SSNs) for some patients; clinical or medical information remained secure.
The company emphasized in the SEC filing that the compromised credentials provided access only through that limited interface. It did not grant access to any other part of the Company’s environment, including its broader network, servers, databases, or other systems.
Following the discovery of the breach, Veradigm initiated incident-response procedures, notified law enforcement, and began an investigation to determine the full scope. Affected individuals are being notified, and credit-monitoring services are being offered where applicable. Based on current information, Veradigm does not believe the incident is reasonably likely to materially affect its business, operations, financial condition, or results.
While Veradigm’s disclosure did not identify the attacker, the ransomware group "The Gentlemen" claimed the intrusion on September 5 and listed the company on its data leak site. The group alleges it holds 3.5 million patient records containing full names, home addresses, SSNs, email addresses, phone numbers, and personally identifiable information. The threat actor has threatened to leak the data by Friday, September 11, if a ransom payment negotiation is not engaged.
The Gentlemen emerged around mid-2025 and operates as a double-extortion group. In recent months, security researchers have linked the gang to a SystemBC proxy malware botnet and noted their use of a new endpoint detection and response (EDR) killer called GentleKiller.
