Veradigm

Veradigm, a healthcare technology company, disclosed that a cybersecurity incident at one of its third-party vendors exposed patients' personal data. The Gentlemen ransomware group claimed the intrusion on September 5 and listed the company on its leak site.

The group alleges it obtained 3.5 million patient records. Veradigm has confirmed a third-party incident and exposure of patient data. It has not adopted the group's number, and this report keeps the confirmation and the claim separate.

The leak site posting alleges names, addresses, phone numbers, email addresses and other personally identifiable information. Veradigm's own disclosure describes patient personal data without a public field breakdown.

The clinical dimension is what makes a healthcare list different from a mailing list. Even where diagnoses are not in the file, the fact that a named person appears in a specific provider's patient records is itself health information, because it says where they sought care.

Patients of Veradigm's customers, which puts them three parties away from the breach. The patient chose a doctor. The doctor chose Veradigm. Veradigm chose the vendor that was compromised.

Nobody in that chain asked the patient, and the patient cannot audit any link in it. When notification arrives it will name a company they have never dealt with, on behalf of a company they have also never dealt with, about a provider they do know.

Veradigm's own systems were not the entry point, and that is worth stating plainly because it is true. The company operates in a heavily regulated sector where business associate agreements and vendor assessments are mandatory rather than optional.

Those instruments assign liability. They do not create visibility. A signed agreement says a vendor will protect data and will notify on breach. It does not tell the covered entity which records the vendor actually holds today, and that is the question that matters at disclosure time.

Which patient records sat with the vendor. The disclosure describes exposure without a confirmed count, while the attacker publishes a precise sounding 3.5 million, and the asymmetry is the story.

This is the third vendor-boundary incident in this series, alongside AdaptHealth's contractor account and the ShipMonk compromise behind Trezor. In each one the breached organization could describe its own systems and could not immediately describe what a partner was holding on its behalf.

A ransomware group listing a victim gets to state a number without evidence. A regulated healthcare company has to establish one. That is correct and it is also why the attacker's figure is usually the only number in circulation for weeks.

The Gentlemen ransomware group claimed it on September 5 and threatened publication, which is the standard double extortion sequence: exfiltrate, list, demand, publish.

Naming the group does not change the patients' position. The leak site claim of 3.5 million remains unverified, and the number that will eventually matter is the one filed with regulators, not the one posted to pressure a negotiation.

Knowing the vendor inventory in advance: which partner holds which records, for which providers, updated rather than signed once at procurement.

The recurring lesson across these entries is that the perimeter somebody else operates is still your disclosure obligation. Healthcare has more contractual machinery around third parties than any other sector in this report, and it produced the same result three times this month, because contracts allocate blame and inventories answer questions.