Stolen vendor credentials pulled patient SSNs out of Veradigm's API

The initial access was the vendor's. A credential issued to that third party for a Veradigm API, one the vendor used to provide services on behalf of Veradigm customers, sat in the vendor's environment, and once the attacker held it the interface did what it was built to do for anyone presenting a valid token ^[3]. What came back was patient personal data ^[4].

The filing does not say how long that credential had been valid, whether the interface capped bulk reads, or when the downloads happened ^[5]. Veradigm did not respond to requests for comment ^[9]. Those gaps are the difference between an incident with a fixed record count and one whose count was set by how long the attacker chose to keep paging through results.

Infrastructure scope and record scope are two different measures of blast radius, and they don't move together here. An API that returns patient data on behalf of thousands of hospitals and doctors worldwide, at a company reporting $594 million in 2024 revenue ^[2], is a sufficient vantage point if patient data is the objective.

The 3.5 million figure is the gang's own inventory description of goods it wants paid for. The gang is prolific enough that the listing is worth logging: hundreds of attacks since it emerged last fall, with Nutex and AnMed among recent healthcare victims ^[10].

Whatever this count turns out to be, the volume sits in the aggregation layer rather than in any one hospital. Aesto reported 9 million people last week ^[13], Baylor Genetics more than 2.8 million from a June incident ^[14], and CareCloud with several other firms 3.7 million from March ^[15]. That is at least 15.5 million people across three disclosures ^[16].

This week's SEC filings show two different failure modes side by side. Boston Scientific is still carrying out substantial restoration of its distribution network, only recently brought back a system managing remote monitoring for cardiac implants, and has said the attack will keep it from its quarterly net sales target ^[17][18]. Veradigm's 2019 SamSam incident was that kind of event too: outages across thousands of hospitals, followed by class action lawsuits ^[11]. A stolen API token causes no outage and no missed guidance; the damage lands entirely on the people whose identifiers moved.

The board-level version of this incident is a list: every vendor holding a live credential to an API that returns your customers' data, and the volume each of those credentials can pull before something trips. Veradigm's disclosure shows what one compromised line on that list is worth to an attacker who never touches the data holder's network ^[7].