Loading story…
Healthcare technology company Veradigm disclosed that an unauthorized party used credentials stolen from a third-party vendor to access a customer-services API and download patient personal data belonging to a limited subset of customers. Some records contained Social Security numbers, but Veradigm said no clinical or medical information was exposed and that its internal network, servers, databases, and operations were not accessed or disrupted.
Veradigm activated its incident-response process, notified law enforcement, and is investigating the scope of the exposure while notifying affected individuals and offering credit monitoring where appropriate. The Gentlemen ransomware group claimed responsibility and alleged it holds 3.5 million patient records, though Veradigm has not attributed the intrusion or verified that claim.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
Veradigm disclosed that stolen credentials from a third-party vendor were used to access a vendor-facing API and download patient personal data, including Social Security numbers in some records. The company said clinical or medical data and its broader internal systems were not accessed, and it initiated incident response, notified law enforcement, and began notifying affected parties and offering credit monitoring where appropriate.
The Gentlemen listed Veradigm on its leak site and claimed to hold 3.5 million patient records. Veradigm did not independently confirm the group’s claim or identify the attacker.
ESET reported that The Gentlemen was using an endpoint-detection-and-response killer named GentleKiller.
Check Point reported that a SystemBC proxy-malware botnet with more than 1,500 hosts was linked to an affiliate of The Gentlemen ransomware group.
The Gentlemen emerged as a double-extortion ransomware group combining data theft and encryption attacks.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
8 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourceteiss.co.uk
Open sourcecyberveille.ch
Open sourcetherecord.media
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcesec.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Veradigm and ApolloMD, both healthcare software and services vendors, reported data breaches to regulators after unauthorized actors accessed sensitive patient data through compromised customer credentials. Veradigm disclosed that the breach originated from a credential obtained from a customer, which was then used to access a Veradigm storage unit containing patient information. The incident, which occurred in December 2024 but was only recently discovered, highlights the ongoing risks associated with third-party vendor security in the healthcare sector. Both companies are notifying regulators and affected parties as required, and the breaches underscore the need for robust third-party risk management and timely breach notification.
Jun 29, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
Adaptavist Group, a UK enterprise software consultancy, disclosed a security breach after an unauthorized actor used stolen credentials in late March to access some of its systems. The company said it launched an internal review and brought in external forensic specialists to investigate, adding that the affected environment held routine business information including contact details, contracts, and NDAs. Adaptavist said it has found no evidence that customer or partner personal data, client systems, or production systems were compromised, and disputed claims that sensitive customer data was accessed or exfiltrated. A ransomware group calling itself **The Gentlemen** claimed responsibility on its leak site and alleged a far broader intrusion, including theft of customer records, source code, internal documents, credentials, and access to production systems, but those assertions remain unverified. Adaptavist also warned that unknown actors are sending misleading emails impersonating the company, suggesting follow-on phishing activity linked to the incident while the forensic investigation continues.
Jun 29, 2026