Veradigm Warns of Patient Data Breach Following Vendor Compromise

Veradigm, a Chicago-based healthcare technology provider, has disclosed a data breach involving the personal information of patients following a cybersecurity incident at a third-party vendor.

The company, formerly known as Allscripts Healthcare Solutions, stated in a filing with the U.S. Securities and Exchange Commission (SEC) that an attacker obtained credentials from a vendor’s environment. These credentials provided access to a Veradigm application programming interface (API) reserved for customer services.

According to the company, the stolen data includes personal details and Social Security numbers (SSNs) for some patients. Veradigm maintained that clinical or medical information remained secure and that the incident did not cause operational disruptions.

Ransomware Group Claims Massive Data Theft

While Veradigm’s official disclosure did not identify the perpetrator, The Gentlemen ransomware group claimed responsibility for the intrusion on 5 September. The group has listed Veradigm on its data leak site, alleging it is in possession of 3.5 million patient records.

The threat actor claims the stolen dataset includes full names, home addresses, SSNs, email addresses, and phone numbers, alongside personally identifiable information (PII) related to guarantors. The Gentlemen has issued an extortion threat, stating they will leak the data by Friday, 11 September, if a ransom payment is not negotiated.

Profile of The Gentlemen

The Gentlemen is a double-extortion ransomware group that emerged around mid-2025. The group typically combines data theft with system encryption across various environments, including Windows, Linux, NAS, BSD, and ESXi systems.

Security researchers have previously linked the group’s affiliates to the SystemBC proxy malware botnet. Additionally, in June 2026, the cybersecurity firm ESET reported that the group had been employing a new endpoint detection and response (EDR) killer known as GentleKiller to evade security software.

Veradigm is currently investigating the full scope of the breach and is in the process of notifying affected customers and individuals. The company has indicated that it does not believe the incident will materially affect its business operations or financial condition.