Gentlemen Ransomware Group Claims Theft of 3.5 Million Veradigm Patient Records: One of the Largest U.S. EHR Data Networks Breached
On September 5 the Gentlemen ransomware group listed U.S. health-tech firm Veradigm (formerly Allscripts) on its leak site, claiming theft of more than 3.5 million patient records including names, SSNs, and contact details. Veradigm operates an EHR data network covering 450,000+ providers and 200 million+ patient records.
On September 5, the Gentlemen ransomware group (Thegentlemen) listed U.S. healthcare data company Veradigm on its dark-web leak site, claiming theft of more than 3.5 million patient personal records covering names, addresses, Social Security numbers (SSN), email, phone, and guarantor information. Veradigm is one of the largest multi-EHR data network operators in the U.S., formerly the well-known EHR vendor Allscripts.
Incident Overview
Veradigm is headquartered in Chicago and listed in the U.S. (OTC: MDRX). Its data network connects more than 450,000 healthcare providers and covers 200 million+ patient records, spanning EHR and practice management, payer analytics, and life-sciences real-world data. Leak-site details indicate the stolen data is primarily patient PII. As of publication, Veradigm has not issued a formal statement on breach scale or data authenticity; attacker-claimed figures still require official verification. This tracks the recent wave of healthcare ransomware: Gentlemen's victim list also includes previously disclosed Nutex Health, AnMed, and other providers.
Technical Details
Gentlemen is a ransomware-as-a-service (RaaS) group that became active around July–August 2025. Its encryptor is written in Go and supports Windows, Linux, NAS, and BSD. Affiliate splits run as high as 90%. Victims span 17+ countries. Threat-intel platforms recorded that a compromised Gentlemen C2 in 2026 exposed more than 1,570 associated victim records; actual scale exceeds leak-site listings. Typical TTPs: valid-account abuse (T1078), exploitation of internet-facing services (T1133/T1190), and phishing (T1566). Double extortion matches most RaaS: steal data, encrypt systems, apply dual pressure.
Impact Assessment
If the claimed scale is accurate, 3.5 million patient records with SSNs can fuel years of identity theft and targeted phishing. Healthcare data cannot be cancelled and reissued like a card; impact is near-permanent. For Veradigm, as a hub connecting a large provider base, trust damage transmits far beyond a single hospital: thousands of downstream EHR-network users may face chained patient-data compliance issues (HIPAA notification, state breach laws). Healthcare remains a ransomware hotspot because data is sensitive, downtime is expensive, and willingness to pay is high.
Remediation Recommendations
- Healthcare orgs and Veradigm-using providers should watch official notices, verify whether their data is in scope, and meet HIPAA/state notification duties.
- Harden internet-facing services (VPN, RDP, telehealth interfaces): enable MFA, purge stale accounts, monitor anomalous logins.
- Run anti-phishing training and mail-gateway policy; add detection for guarantor-billing medical social-engineering lures.
- Follow 3-2-1 backups with offline isolation; drill restores regularly so backups are not encrypted too.
- Threat intel: fold Gentlemen TTPs (valid-account abuse, Go encryptor, high-split RaaS) into detection use cases and exercise scenarios.
References
- Cyber Threat Intelligence: Veradigm incident record involving Thegentlemen ransomware
- Ransomware.live: ransomware leak-site monitoring platform