Veradigm, the Chicago-based health-IT company formerly known as Allscripts, disclosed a data breach in September 2026 after an intruder used stolen credentials from a third-party vendor to break into a customer-service API. The attack exposed patient personal data, including Social Security numbers in some cases, and has already drawn two proposed class-action lawsuits. Veradigm reported the incident in a Form 8-K filed September 8, 2026, stating that the unauthorized access was confined to that single customer-service interface rather than its broader network, according to Veradigm's SEC filing reported by HIPAA Journal. The company says no clinical or medical data was taken and that its operations continued without disruption, per the 8-K details covered by BleepingComputer.
Official resource:
- Explore the official data from Bleepingcomputer — Use this primary source to review the underlying data.
Table of Contents
- What Happened in the Veradigm Breach
- The Two Lawsuits Filed Against Veradigm
- Am I Affected, and What Should I Do Now?
- How This Compares to Veradigm's 2025 Breach Settlement
What Happened in the Veradigm Breach
An unauthorized party obtained a third-party vendor's stolen login credentials and used them to access Veradigm's customer-service API. Veradigm has not named the compromised vendor publicly, and its filing does not state how many individuals were affected by this specific incident, according to HIPAA Journal's coverage of the 8-K. The intruder downloaded copies of patient personal data, and in some cases that included Social Security numbers.
A ransomware group calling itself "The Gentlemen" claimed responsibility and said it holds more than 3.5 million patient records, threatening to publish them if Veradigm did not pay by September 11, 2026. That figure comes from the group itself and has not been confirmed by Veradigm or any regulator, per BleepingComputer's reporting on the claim. Veradigm is a health-IT vendor, not a direct healthcare provider, so the people affected are patients whose data passed through the compromised API on behalf of Veradigm's healthcare-provider clients. They are not Veradigm's own direct patients.
The Two Lawsuits Filed Against Veradigm
Two proposed class-action lawsuits followed the disclosure, both filed in the U.S. District Court for the Northern District of Illinois. Clay v. Veradigm, Inc. (No. 1:26-cv-10827) was filed September 8, 2026, and Walker v.
Veradigm, Inc. (No. 1:26-cv-10852) followed on September 9, 2026, according to HIPAA Journal's report on the filings. Both complaints allege that Veradigm failed to adequately secure patients' personal and health information. They seek damages and security improvements on behalf of a proposed nationwide class. Neither case has reached a ruling or settlement as of this writing.
- Clay v. Veradigm, Inc. — No. 1:26-cv-10827, filed September 8, 2026
- Walker v. Veradigm, Inc. — No. 1:26-cv-10852, filed September 9, 2026
- Court: U.S. District Court for the Northern District of Illinois
- Status: both pending, no ruling or settlement yet
Am I Affected, and What Should I Do Now?
You may be affected if you are a patient of a healthcare provider that uses Veradigm's customer-service systems, even though you have no direct relationship with Veradigm itself. The exact number of people affected has not been disclosed.
Veradigm says notifications and credit-monitoring offers are being issued where applicable while its investigation continues, per the company's 8-K cited by HIPAA Journal. Watch for a letter from Veradigm or from the healthcare provider you use that relies on Veradigm's systems.
- Watch your mail and email for a breach notification letter naming Veradigm or your provider
- Enroll in any credit-monitoring service offered in that letter
- Check your credit reports and bank statements for unfamiliar activity, especially if Social Security numbers were involved
- Keep the notification letter — it documents your eligibility if a settlement is reached later
- Do not provide personal information to anyone contacting you by phone claiming to be "Veradigm security" unless you initiated the contact
How This Compares to Veradigm's 2025 Breach Settlement
This is Veradigm's second major breach litigation in two years. An earlier case, over a December 2024 hacking incident discovered July 1, 2025 and affecting roughly 2.5 million patients across more than a dozen healthcare-provider clients, ended in a $10.5 million class settlement, according to Veradigm's FY2024 Form 10-K reported by BankInfoSecurity. Under that 2025 settlement, class members could claim up to $5,000 for documented losses or roughly $50 as a pro rata payment, plus two years of medical identity-theft monitoring.
The court entered a Final Approval Order on March 26, 2026, per the same 10-K filing covered by BankInfoSecurity. That prior case offers a rough template for what the new lawsuits might produce if they also reach settlement: documented-loss claims paid at a higher tier, a smaller pro rata payment for everyone else, and a period of free identity-monitoring. No such terms exist yet for the September 2026 breach, since both new cases remain in early litigation.