Veradigm data breach: a customer's stolen credential opened a storage account, 2,672,036 people

What happened at Veradigm?

On July 1, 2025 Veradigm discovered that some of its customers' data had been accessed by an unauthorized party. It found that after a security incident at another customer, the attacker had used a credential taken from that customer to get into a Veradigm storage account. The access happened around December 15, 2024. Veradigm says it learned of it only through a third party investigating the original incident, and that no other Veradigm systems were affected.

Date	What happened	Source
Around December 15 to 16, 2024	Storage account accessed with the stolen credential	Veradigm letter; Oregon list
July 1, 2025	Veradigm discovers the access	Veradigm letter; Oregon list
September 22, 2025	First letters	Veradigm letter; Oregon list
November 10, 2025	Second round of letters	Oregon list
December 2, 2025	Third round; report to Oregon (2,672,036)	Oregon list

The first letters went out 281 days after the access and 83 days after Veradigm found it. The notice-delay guide compares that with other notices.

Why did I get a letter about Veradigm?

Because your doctor's practice uses Veradigm software. The letter says Veradigm provides software solutions to healthcare providers and practices, and it names the recipient's practice. It stresses that the first breach was at a different customer, not your practice. The guide to why you got a breach letter from a company you never dealt with explains vendor notices like this one.

What information was exposed?

It varies by person. The letter lists name, contact details, date of birth, health records data such as diagnoses, medications, test results and treatments, health insurance information and payment details. For some people it also includes Social Security or driver's license numbers. Veradigm says it has no evidence the information has been misused.

How did Veradigm find out about the breach?

From someone else's investigation. The HIPAA Journal reported that Veradigm learned of the access through a third party that was investigating its customer's security incident. The breach was limited to the one storage account, and no other Veradigm systems or environments were affected, according to the same report. Veradigm, which sells practice management and electronic health record software to healthcare providers, was formerly Allscripts.

Is the 2,672,036 count confirmed?

Yes, by three separate sources. The federal health breach portal, checked on November 13, 2026, lists Veradigm LLC as a business associate with 2,672,036 people affected, in a hacking incident on a network server reported on September 22, 2025. Oregon's list records the same 2,672,036. The HIPAA Journal's June 2026 update to its report says Veradigm determined that the breach affected 2,672,036 individuals. In September 2025 the count was still open. The HIPAA Journal then put the confirmed total at at least 70,000, based on reports to the Texas and South Carolina attorneys general. Over three rounds of letters, the count grew to about 38 times that.

What is Veradigm offering?

Complimentary credit monitoring and identity protection through Experian IdentityWorks, for the number of months printed in each letter, which must be activated with the code given. The guide to credit monitoring offers explains what a free credit freeze adds.

How many Washingtonians were affected by the Veradigm breach?

Washington's attorney general lists a notice from Veradigm LLC, reported on December 2, 2025, with a breach date of December 15, 2024 and 845 Washingtonians affected. The record lists names, Social Security numbers, driver's license or state ID numbers, financial and banking information, full dates of birth, health insurance policy or ID numbers, medical information and other information as the information compromised. The figure counts Washington residents only.

How many Texans were affected by the Veradigm breach?

Texas's attorney general lists a report from Veradigm LLC, posted on December 19, 2025, with 43,684 Texans affected. It lists names, addresses, Social Security numbers, driver's license numbers, medical information, health insurance information, other information and dates of birth among the information involved. Texas posted it in 2025, so it is not in the 2026 Texas ranking. The figure counts Texas residents only; the public list gives no national total.

What the record leaves open

• Which customer's breach exposed the credential.
• Why the storage account could be opened with one customer's credential.
• How many practices' patients are among the 2,672,036.