Veradigm disclosed on September 8, 2026, that a cybersecurity incident involving one of its third-party vendors exposed personal information of patients associated with a small number of its customers.

 

What happened

In a Form 8-K filing with the Securities and Exchange Commission, an unauthorized party obtained credentials from the vendor’s environment for a Veradigm application programming interface (API) used by the vendor to serve customers. The attacker used those credentials to download copies of certain patient data, which included Social Security numbers in some cases. Veradigm said the affected information did not include clinical or medical data.

The compromised credentials provided access only through the limited API and did not allow entry into Veradigm’s broader network, servers, databases, or other systems. The company said the incident did not disrupt its operations. After learning of the incident, Veradigm activated its cybersecurity response procedures and notified law enforcement. Its investigation remains ongoing.

 

In the know

According to reporting from Beckers Health IT, “The disclosure marks at least the second cybersecurity incident Veradigm has reported to customers in the past year, following a 2024 data breach the company began notifying patients about in September 2025.” According to the company’s breach notification, Veradigm discovered the incident on July 1, 2025, after a third party investigating a separate security incident alerted the company to the activity. The attacker had obtained a credential from one of Veradigm’s customers and used it to access the storage account around December 15, 2024.

The compromised account was used for data migrations and contained information from other Veradigm customers, including protected health information (PHI). Depending on the individual, exposed information could have included names, contact information, dates of birth, diagnoses, medications, test results, treatments, health insurance information, payment information, and limited identifiers such as Social Security or driver’s license numbers. Veradigm said the intrusion did not affect its primary network, healthcare providers’ active customer systems, or daily operations, and it began notifying affected individuals in September 2025.

 

Why it matters

Threat actors have used similar methods in other large-scale data theft campaigns, targeting trusted integrations instead of directly breaching a company’s central systems. In August 2025, the Google Threat Intelligence Group reported that the group it tracks as UNC6395 used compromised OAuth tokens associated with the third-party Salesloft Drift application to access Salesforce customer instances and systematically export corporate data. The attackers then searched the stolen information for passwords, Amazon Web Services access keys, and Snowflake tokens that could support further intrusions. Google said the campaign did not result from a vulnerability in Salesforce’s core platform.

The approach resembles the pattern described by Veradigm. Credentials obtained from a vendor’s environment were used through an authorized interface to access customer-associated data. However, Veradigm has not attributed its incident to UNC6395 or any other known group. The risk is particularly relevant in healthcare because external vendors regularly connect to healthcare systems and process sensitive information. Paubox’s 2025 mid-year email breach report found that business associates, including billing companies, imaging firms, and outsourced IT providers, were involved in 17 of 107 email-related healthcare breaches, representing 16% of the incidents analyzed.

 

FAQs

Which factors determine who is responsible for a HIPAA breach?

It depends on whether the affected information qualifies as protected health information and which covered entities or business associates were responsible for it under HIPAA.

 

Why can an API credential give an attacker access to patient information?

An API credential acts as proof that an application is authorized to request certain data, so a stolen credential can allow an attacker to make requests that appear legitimate until the credential is disabled.

 

Can healthcare organizations prevent vendors from accessing more data than they need?

Yes, organizations can restrict API permissions, limit the data available to individual integrations, rotate credentials, and monitor unusual API activity.