DisclosureLens
FEDERALItem 8.01 · voluntaryHackingTechnologyHealthcareInformationStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIGovernment IDMediumActive

Veradigm LLC

bd_0af693b915bd8f99 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Filed

Sep 8, 2026

To disclose

Affected

Not disclosed

Linked

8 filings

Confidence

69%
Full breach record for Veradigm LLC2 incidents on file

Veradigm Inc. disclosed a cybersecurity incident involving a third-party vendor. An unauthorized party obtained credentials from the vendor's environment to access a specific API used to serve Veradigm's customers. The attacker used these credentials to download copies of certain patient personal data, including, in some instances, Social Security numbers. No clinical or medical data was involved. Veradigm notified law enforcement, is reviewing affected data, and is notifying customers, offering credit monitoring where applicable. The incident did not cause operational disruptions.

Incident timeline — partial

? — ?

Breach window unknown

Sep 8, 2026

Filed

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Show 2 more filingsup to 352d gap

Filing propagation · 7 filings · 6 states

View merged incident ↗
Massachusetts State AGSep 22 · first
Montana State AGSep 22 · first
Vermont State AGSep 22 · first
HHS OCRSep 22 · first
California State AGSep 22 · first
SEC 8-K+352d · this page

Pattern: first filing Sep 22 (SC), last Sep 8 — a 352-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.