Veradigm Listed by The Gentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In a listing dated September 04, 2026, the ransomware group known as The Gentlemen has named Veradigm on its leak site. The listing presents an unverified accusation; public detail beyond that claim is limited, and Veradigm has not publicly confirmed any incident as of writing. People affected, if any, are unknown, and the exact nature of any files the group says it holds has not been independently established.

Listings of this kind matter because Veradigm operates in healthcare technology and analytics, a sector that routinely handles sensitive clinical and administrative information. Until a company, regulator, or other independent source confirms or refutes a claim, readers should treat the post as an allegation and focus on conditional precautions rather than assuming their records are involved.

Inside the listing

According to the reported summary tied to the leak-site entry, The Gentlemen has listed Veradigm and associated web references including veradigm.com and a ZoomInfo company profile. The group’s materials, as reflected in that summary, claim involvement of 3.5-plus million personal patient records and describe categories such as full name, address, Social Security number, email, phone number, and guarantor-related personal information. Those descriptions are the attackers’ own framing, not a verified inventory.

The number of people affected remains unknown in public reporting. Method of access, timing of any alleged intrusion, ransom demands, and whether any files were actually copied or released are undisclosed in the material provided. Nothing in the available record confirms that data left Veradigm systems or that a leak has occurred. A leak-site listing establishes only that a named group chose to publish a claim; it does not by itself prove theft, encryption, or publication of records.

Who is The Gentlemen?

The Gentlemen is a ransomware and extortion brand that has appeared in public reporting as operating a double-extortion model: encrypting systems where it can and threatening to publish stolen data on a dedicated leak site if payment is not made. Like other groups in this category, it typically seeks initial access through common enterprise weak points, moves laterally where possible, and uses leak-site pressure to increase leverage. Public coverage of such actors emphasizes that listings can mix fresh claims with recycled or inflated material, and that groups have strong incentives to overstate scale and sensitivity.

For this specific entry, only what appears on or is summarized from the listing should be attributed to the group. The Gentlemen claims Veradigm is a victim and markets a large volume of patient-related personal data; those statements have not been corroborated here by the company or by independent confirmation. Readers should not equate a leak-site post with proof of a completed breach.

Who is Veradigm?

Veradigm is a publicly traded American healthcare technology and data analytics company (OTC: MDRX), formerly known as Allscripts, founded in 1986 and renamed Veradigm in January 2023. It is headquartered in Chicago and employs on the order of roughly 2,300 to 2,600 people. In general public description, its business centers on electronic health record–related networks, provider connectivity, and analytics built on large volumes of healthcare data.

Organizations in this space commonly sit between clinicians, health systems, and secondary uses of clinical and administrative data. A credible incident affecting such a firm would be consequential because of the sensitivity of health-adjacent records and the number of patients and providers that can appear in multi-EHR or analytics environments. That sector context explains why a leak-site claim draws attention; it does not establish that Veradigm systems were compromised in this case.

The information in question

Structured fields for this report list data types named as exposed as not disclosed. Separately, the attackers’ listing summary claims more than 3.5 million personal patient records and enumerates elements such as full name, address, Social Security number, email, phone, and guarantor PII. Because that content is unverified marketing from the group, it should not be read as a confirmed catalog of what, if anything, was taken.

If files of the kind healthcare technology and analytics firms typically hold were involved, such organizations often maintain identifiers, contact details, insurance or guarantor information, and clinical or claims-related data tied to large provider networks. Veradigm is publicly associated with a substantial multi-EHR data footprint and hundreds of millions of patient records in its commercial narrative; that describes the sector’s usual data intensity, not a verified loss in this incident. Exact contents tied to the Gentlemen listing remain unconfirmed.

The real-world impact

If personal data of the sort the group describes were genuinely obtained and misused, affected individuals could face risks such as targeted phishing, identity fraud, or attempts to open accounts or file claims using stolen identifiers. Healthcare-linked records can be especially useful to criminals because they combine identity elements with context that makes social engineering more convincing. Those outcomes are conditional on actual exfiltration and abuse; a listing alone does not prove either.

For the organization, an extortion listing can mean reputational pressure, customer and partner questions, regulatory interest if a reportable event is later confirmed, and the operational cost of investigation—whether or not the claim is accurate. For the public, the practical harm depends on whether personal information truly circulated and how it is used. Until confirmation exists, impact should be discussed as possibility, not as an established event affecting named patients or employees.

What to do now

If you have a relationship with Veradigm as a patient, provider, employee, or partner, treat the Gentlemen listing as a prompt to heighten caution rather than as proof your data is public. Watch for unexpected messages that reference health records, billing, or “breach assistance,” and verify any outreach through official channels you already trust. Consider placing a fraud alert or credit freeze if you are concerned about identity misuse, and review account statements and explanation-of-benefits notices for activity you do not recognize. Use unique passwords and multi-factor authentication on email and healthcare portals so a single exposed credential is less useful.

If you want a concrete next step, you can run a free exposure scan of your email address to check whether that address has already appeared in known breach datasets from other incidents. That check does not confirm or deny involvement in this unverified listing, but it can help you prioritize password changes and monitoring. Stay with official company or regulator notices for any future confirmation; until then, conditional hygiene is the proportionate response to an unproven leak-site claim.

AICompiled with AI assistance from public sources and published under our editorial standards.