Veradigm Data Breach 2025 (Rhysida Ransomware): 2.67M Patients of Provider Customers Exposed. $10.5M Settlement Preliminarily Approved. What To Do

What happened

Veradigm LLC is a Chicago-based healthcare IT vendor. It is the same company that operated as Allscripts Healthcare Solutions until a 2022 rebrand, and it sells electronic health record (EHR) software, practice management systems, payer analytics, and provider data feeds to physician practices, health systems, and insurers across the United States. Veradigm was publicly traded on Nasdaq under the ticker MDRX until February 2024, when Nasdaq delisted the company for failing to file required SEC reports on time after a series of financial restatements. The stock is now quoted on the over-the-counter market.

The 2025 breach did not originate inside Veradigm. According to Veradigm’s own notice and to follow-on reporting, in December 2024 the Rhysida ransomware group compromised one of Veradigm’s clients, Sunflower Medical Group in Kansas. While inside Sunflower’s network, Rhysida stole valid credentials that Sunflower used to access a Veradigm storage account. The attackers then used those credentials to log in to Veradigm’s storage environment and exfiltrate data on or around December 15, 2024.

Veradigm did not learn of the access for nearly seven months. On July 1, 2025, the third-party firm investigating Sunflower’s incident informed Veradigm that the attackers had moved laterally from Sunflower into Veradigm. Veradigm began notifying state attorneys general and mailing individual notification letters on September 22, 2025, and filed the breach with HHS OCR the same day. The OCR record lists 2,672,036 affected individuals, type “Hacking/IT Incident,” location “Network Server,” and Veradigm’s role as Business Associate.

Veradigm’s public statement frames the incident narrowly: “This incident did not affect Veradigm’s primary network, customer systems actively used by providers, or daily operations.” DataBreaches.net challenged that framing on November 1, 2025, reporting that the Rhysida leak-site tranche for Sunflower included subdirectories of data from at least four downstream Veradigm clients (Urology Associates of Mobile, Cabarrus Eye Center, Family Medical Group of Texarkana, and Peachtree Neurological / Piedmont Physicians Group Peachtree Neurology), meaning the stolen data appears to have been published on the dark web rather than contained.

Why you are hearing about it from your doctor, not from Veradigm

This is the part most patients find confusing. Veradigm is a business associate under HIPAA. It does not have a direct treatment relationship with you. The HIPAA Breach Notification Rule lets a business associate either notify affected individuals itself or delegate that duty back to the covered entity (the practice or hospital you actually saw). Veradigm took the second approach: it identified the affected files, packaged the names and addresses by client, and asked each affected provider to send the notification letters in its own name.

That is why your letter likely came from a name you recognize. Practices that have been publicly linked to this incident include:

• Sunflower Medical Group (Kansas; also includes Heartland Primary Care and Women’s Clinic Associates) — the original Rhysida victim and source of the stolen credentials
• Urology Associates of Mobile (Alabama)
• Cabarrus Eye Center (North Carolina)
• Family Medical Group of Texarkana (Texas / Arkansas)
• Peachtree Neurological, now Piedmont Physicians Group Peachtree Neurology (Georgia)
• UofL Health (Kentucky; posted a Veradigm HIPAA media notice on its website in November 2025)

This is almost certainly a partial list. State attorney general filings in South Carolina and Texas alone accounted for roughly 70,000 affected individuals. With 2.67 million people in total, dozens of additional Veradigm provider clients are involved.

What was stolen

The data elements Veradigm has confirmed in its substitute notice and in state attorney general filings:

• Full name
• Contact information (address, phone, email)
• Date of birth
• Social Security number (subset of affected individuals)
• Driver’s license number (subset of affected individuals)
• Health insurance information (insurer, member ID, claim details)
• Medical records information: diagnoses, medications, test results, treatments
• Payment details

Because the stolen data was published on Rhysida’s dark web leak site (according to DataBreaches.net’s review of the Sunflower tranche), this is not a hypothetical-risk breach. The data is in circulation.

The $10.5M class action settlement is already preliminarily approved

The class action filed against Veradigm consolidated in the U.S. District Court for the Northern District of Illinois as Goodrum, et al. v. Veradigm, Inc., No. 1:25-cv-07062. Lead plaintiffs include Tony Goodrum, Jason Mixton, Marty Wooley, Todd Clay, and Tanya Walker. The court (Judge John Robert Blakey) granted preliminary approval of the settlement on November 6, 2025.

Settlement terms:

• $10,500,000 non-reversionary settlement fund covering all class member benefits, administration costs, attorneys’ fees, and service awards
• Tier A: Up to $5,000 reimbursement for documented out-of-pocket losses tied to the breach
• Tier B: Approximately $50 cash payment (pro-rata adjusted based on claim volume) for class members who cannot or do not document specific losses
• All class members: Two years of medical-data monitoring (a different product class from credit monitoring; designed to catch medical identity theft signals such as insurance fraud, prescription fraud, or unauthorized care billed under your name)

Class definition: living US residents who were sent a notice that their Private Information may have been impacted by the Veradigm data incident.

Key deadlines:

• February 17, 2026 — opt-out and objection deadline
• March 16, 2026, 9:00 a.m. ET — claim submission deadline
• March 18, 2026 — final fairness hearing

The settlement administrator is Kroll Settlement Administration LLC. The official claim portal is at veradigmdatasettlement.com.

Veradigm denies all wrongdoing and is settling without admission of liability.

What Veradigm is offering directly

Independent of the class action, Veradigm offered complimentary Experian IdentityWorks credit monitoring and identity-theft protection to affected individuals. The enrollment code and instructions are in the individual notification letter. The duration is two years for individuals whose Social Security numbers or driver’s license numbers were exposed.

What to do if you received a letter

This week:

1. Enroll in the credit monitoring. Use the enrollment code in your letter to activate the Experian IdentityWorks subscription. It is free to you. Then place free credit freezes at all three nationwide consumer reporting agencies (Equifax, Experian, TransUnion). The freezes do more than the monitoring does, because they prevent new accounts from being opened in your name at all.
2. File the class action claim. Visit veradigmdatasettlement.com before the March 16, 2026 deadline. If you have any documented losses (fraudulent charges, time spent dealing with the breach, costs of credit reports, lost wages from dealing with identity theft), submit them under Tier A. Otherwise file under Tier B for the cash payment. Either tier also gets you two years of medical-data monitoring.
3. If your letter mentions SSN or driver’s license exposure: file IRS Form 14039 (Identity Theft Affidavit) and place a fraud alert with the Social Security Administration. Tax-refund fraud and unemployment-insurance fraud are common downstream consequences.

This month:

4. Decide whether to opt out. The opt-out deadline is February 17, 2026. Opting out preserves your right to sue Veradigm individually but forfeits your right to any class settlement benefit. For most affected individuals the class settlement is the better option, but if you have catastrophic documented losses you may want to consult a plaintiffs’ attorney directly. We are not a law firm.
5. Stop the ongoing flow of your medical data. The data Rhysida posted publicly includes diagnoses, medications, and treatments. Once that data is in the wild, it is bought, enriched, and resold by data brokers, ad-tech firms, and consumer-health platforms. HealthConsent files HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests across the data-broker ecosystem so the medical record exposed in this breach is not continuously re-sold downstream. Credit monitoring and the class settlement address financial fraud. They do not address the flow of your diagnoses through the data-broker layer.

Frequently asked questions

Veradigm says its primary systems were not affected. Is my data still at risk?

Yes. Veradigm’s statement refers to its production EHR and practice management environments, which were not encrypted or otherwise disrupted. But a storage account containing 2.67 million patient records was accessed, and DataBreaches.net’s review of the Rhysida leak-site tranche indicates Veradigm client data was published publicly. The distinction matters operationally for Veradigm but not for your personal exposure.

How did Rhysida get in if Veradigm itself was not hacked?

Through credential reuse. Sunflower Medical Group, a Veradigm client, was compromised first. Rhysida found credentials inside Sunflower’s environment that Sunflower legitimately used to log in to a Veradigm storage location, then used those credentials to access Veradigm directly. This is a common business-associate-breach pattern: the vendor is not breached at the perimeter, but a customer’s stolen credentials become the path in.

Why did the OCR filing take nine months from the original incident?

Veradigm has stated that it did not learn of the access until July 1, 2025, when the firm investigating Sunflower’s breach told them. From that discovery date, the OCR filing on September 22, 2025 is within HIPAA’s 60-day window. The longer timeline reflects how long Sunflower’s own forensic investigation took before the lateral movement into Veradigm was identified.

Is Veradigm still in business?

Yes, though its corporate status is unusual. Veradigm was delisted from Nasdaq in February 2024 for failing to file SEC reports on time after a series of accounting restatements. The stock is currently quoted over-the-counter under the ticker MDRX. The company continues to operate its EHR, practice management, and payer-data businesses normally.

Is HealthConsent affiliated with Veradigm, the class action, or any provider customer?

No. HealthConsent is an independent health-data privacy service.

Continue reading

• Your eight HIPAA rights, in plain English
• ApolloMD Data Breach 2026 (Qilin Ransomware, 626,540 affected)
• TriZetto Provider Solutions Breach 2026 (3.4M affected)
• Other 2025 healthcare data breaches