Veradigm veradigm.com Veradigm data breach: what happened and what to do
An attacker used a credential from another customer to reach one Veradigm storage account, with access dating to about December 15, 2024. Veradigm found it on July 1, 2025. 2,672,036 people were affected. Health records, insurance details and for some, Social Security numbers were exposed.
View all 13,115 breaches- Breach date
- 15 Dec 2024
- Made public
- 22 Sept 2025
- Affected
- 2,672,036
- Data exposed
- Names, Dates of birth, Medical records, Health insurance information, Social security numbers, Driver's licenses
- Last updated
What happened
Veradigm provides electronic health record and data software to healthcare practices. Its notice says a data security incident hit one of its other customers, and the unauthorized party used a credential obtained from that customer to reach a single Veradigm storage account. The access dates to about December 15, 2024. Veradigm says it discovered on July 1, 2025 that data belonging to some of its customers had been accessed, and that only that one storage account was affected.
The company first indicated a much smaller number of affected people. It has since determined that 2,672,036 individuals were affected, which is also the figure the HHS breach portal shows. Many people learned about it from their own medical practice, which posted a notice or mailed a letter, and some practices posted a substitute notice on their website because they lacked current mailing addresses.
What was exposed
The notices list names, contact details, dates of birth, health records, health insurance information, payment details, and limited identifiers such as Social Security and driver's license numbers. The health records can include diagnoses, medications, test results and treatments. What was exposed varies from person to person.
What that lets criminals do
Health records are the part you can't replace. A diagnosis or a medication list doesn't expire, and it can be used to pressure someone or to craft a message that sounds like it came from your clinic. For most people the realistic risk is targeted phishing and text scams that mention a real condition or a real practice.
Where a Social Security number or driver's license number was included, the risk extends to identity theft: new credit accounts, fake tax returns and phone contracts opened in your name. Insurance details add medical identity theft, where someone uses your coverage to get care.
Payment details are listed in the notices for some people. If that includes a card, the fix is quick: ask the issuer for a new one.
The company's response
Veradigm offered affected people complimentary credit monitoring and identity theft protection. A class action over the incident has reached a preliminary settlement. According to coverage of the settlement terms, eligible people can claim up to $5,000 for documented losses tied to the incident, or take a pro rata payment of around $50. Terms and deadlines change, so check the official settlement website for the current dates before you rely on any of this.
How to protect yourself
Read your notice to see which of your details were involved, then work down the list. Freeze your credit if a Social Security number was included, replace any card that was listed, and read your insurance statements for care you didn't get. Treat any message that mentions your health or your practice as suspect until you've confirmed it through a number or site you looked up yourself.
What to do if you were in it
- 1
Read your notice
Your practice's notice or letter says which of your details were involved. Take the credit monitoring if it's offered.
- 2
Freeze your credit
Place a free credit freeze at Equifax, Experian and TransUnion. A freeze stops lenders from seeing your credit report, which blocks most new accounts opened in your name. You place it separately at each bureau, and you can lift it when you apply for credit yourself.
- 3
Replace any card that was listed
If payment details were involved for you, ask the issuer for a new card and turn on transaction alerts.
- 4
Watch your insurance statements
Read each explanation of benefits and ask your insurer about care you didn't receive.
- 5
Be wary of messages about your health
Scammers can quote a real condition or practice. Confirm any message by calling a number you look up yourself.
- 6
Check whether your email or phone is in this and other breaches
Serus runs a free scan that looks for your email address and phone number in breach databases and on the dark web, and alerts you if they turn up. Serus can't remove data from a breach, but it tells you what to change.
Frequently asked
Was I affected by the Veradigm breach?
Veradigm says 2,672,036 people were affected. If a practice that uses Veradigm had your records, check for a letter or a notice on the practice's website.
What was exposed?
Notices list names, contact details, dates of birth, health records, insurance and payment details, and limited Social Security and driver's license numbers. It varies by person.
Is there a settlement?
Coverage of a preliminary class action settlement says eligible people can claim up to $5,000 for documented losses or about $50 pro rata. Check the official settlement site for current terms and deadlines.
Should I freeze my credit?
If a Social Security number or driver's license number was in your notice, yes. A freeze is free.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
