Veradigm Confirms Patient Data Theft After Vendor Credentials Stolen; Ransomware Crew Claims 3.5 Million Records
The Chicago health-tech firm told the SEC that attackers used a vendor's login to a customer-service API. The Gentlemen ransomware group says it grabbed millions of patient records.
Key points
- Veradigm, formerly Allscripts, told the SEC that attackers stole a vendor's login and used it to copy patient data through a customer-service software connection.
- Stolen data includes names, addresses and Social Security numbers; clinical and medical records were not touched.
- The Gentlemen ransomware gang listed Veradigm on its leak site on 5 September, claiming 3.5 million patient records.
- The gang threatened to publish the data on 11 September if Veradigm refused to open ransom talks.
- Affected patients are being notified and offered credit monitoring; HHS Office for Civil Rights will handle HIPAA follow-up.
Veradigm, the Chicago health-tech company once known as Allscripts, has told U.S. Regulators that patient data was stolen after attackers got hold of a login belonging to one of its outside suppliers.
The company sells software to thousands of hospitals and biopharmaceutical firms across the United States. Its products handle electronic health records, e-prescribing, patient billing and practice management.
In its filing with the U.S. Securities and Exchange Commission, Veradigm said the intruders obtained credentials from a vendor's environment. Those credentials opened a Veradigm API, a software connection used to move data between systems, reserved for customer service work. The attackers then copied patient information through it. The vendor's login reached only that narrow interface and nothing else in Veradigm's environment, the filing states.
What was actually stolen?
Names, home addresses, email addresses, phone numbers and Social Security numbers for some patients. Medical and clinical records were not touched, according to Veradigm.
Veradigm hasn't put a public number on how many people are affected, describing the group of impacted customers as small. In a company of Veradigm's size, that word does a lot of lifting.
A ransomware gang calling itself The Gentlemen claims the figure is 3.5 million patient records. First reported by BleepingComputer, the group added Veradigm to its dark-web leak site on 5 September and set an 11 September deadline for ransom talks to begin, after which it threatened to publish the files.
Who are The Gentlemen?
A relatively new criminal crew that steals data and encrypts victims' systems, then demands payment to suppress the data and restore access. This tactic is called double extortion. We've tracked the group across eight stories since first covering them on 5 June 2026.
The gang appeared around mid-2025. Its leak site lists more than 800 victims across 86 countries, spanning manufacturing, healthcare, financial services and technology. That spread suggests the crew hits whoever it can access rather than selecting targets deliberately.
Check Point reported in April 2026 that an affiliate ran a proxy-malware botnet of more than 1,500 machines using SystemBC, a tool designed to conceal criminal traffic. ESET followed in June 2026 with a writeup on GentleKiller, a tool the gang uses to disable endpoint detection and response software, the security products that watch company devices for suspicious behaviour.
Timeline and known facts
| Date | Event |
|---|---|
| Around Sept 2025 | Attackers use stolen vendor credentials to access Veradigm customer-service API |
| 5 Sept 2025 | The Gentlemen list Veradigm on their leak site, claiming 3.5 million records |
| 11 Sept 2025 | Gang's deadline to publish stolen data |
| Ongoing | Veradigm notifying affected individuals, offering credit monitoring |
Because the stolen data involves patient information held by a U.S. Health-tech vendor, the breach falls under HIPAA. The U.S. Department of Health and Human Services Office for Civil Rights will handle regulatory follow-up, and state attorneys general may open their own inquiries. Vendor-credential breaches in healthcare aren't new: our McKesson story from 28 August and the Aesto Health breach affecting 9.5 million people reported 1 September show the same pattern repeating with different companies and wildly different claims about scale.
Should you worry?
If you receive a notification letter from Veradigm or one of its healthcare clients, take up the free credit monitoring. Place a fraud alert or credit freeze with the three major U.S. Credit bureaus to block new accounts being opened in your name. Watch for follow-on scam calls referencing your medical provider or the breach itself: that's a routine play after real incidents like this one.
The gap between Veradigm's "small" and The Gentlemen's 3.5 million is the number to watch. When HHS receives the official breach report, that figure becomes public and will tell us which side is closer to the truth.
