Veradigm

CriticalConfirmedHealthcareSeptember 8, 2026

Veradigm, a US healthcare technology vendor (electronic health records, e-prescribing), disclosed on September 8, 2026 an intrusion via compromised credentials at a third-party vendor, which granted access to an API reserved for customer services. The attacker copied personal data for a subset of patients, including Social Security numbers; no clinical or medical data was affected. The Gentlemen ransomware group claimed the attack on September 5, 2026, alleging it holds about 3.5 million records (names, addresses, Social Security numbers, emails, phone numbers) — a volume not confirmed by Veradigm.

Social Security numbers exposed alongside names and addresses could enable identity theft or fraudulent account opening in victims' names.

Disclosed on: September 8, 2026
Accounts affected: 3.5M
Sector: Healthcare
Country: United States
Cause: Third-party provider

Exposed data

Full name
Postal address
Phone number
Email address
Social security number

You are only affected if you had an account or an order with this organisation.

What you can do

Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

Sources

Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact