Patients whose personal information was taken in Veradigm’s September 2026 data breach may be covered by a proposed class action alleging the health technology company, formerly called Allscripts, failed to protect data that included Social Security numbers. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a class action complaint. The statements below are unproven allegations. Veradigm, Inc. has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
Veradigm, Inc., the Chicago-based health care technology company formerly known as Allscripts Healthcare Solutions, was sued on September 8, 2026 in the U.S. District Court for the Northern District of Illinois over a data breach it disclosed the same day. The case is Clay v. Veradigm, Inc., No. 1:26-cv-10827. A second proposed class action, Walker v. Veradigm, Inc., No. 1:26-cv-10852, followed in the same court the next day.Veradigm told investors that someone used a vendor’s stolen credentials to pull patient data, in some cases including Social Security numbers, through one of its systems. The complaint alleges Veradigm failed to secure that data and seeks damages and identity protection for everyone affected. The case was just filed; Veradigm has not been found liable and the court has not ruled.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Veradigm Has Said
In a Form 8-K filed with the Securities and Exchange Commission on September 8, 2026, Veradigm said a third-party vendor had been breached and that unauthorized people used the vendor’s credentials to access one Veradigm application programming interface (API). According to the filing, they obtained certain personal data of patients, “in some instances” including Social Security numbers, and no clinical or medical data was involved.Veradigm said the credentials worked only through that one interface and gave no access to the rest of its systems, that the incident affected patients of a small number of its customers, that it caused no operational disruption, and that the company does not expect it to have a material impact on its business. The filing did not say how many people were affected.
What the Lawsuit Alleges
The complaint alleges the incident happened on or around September 5, 2026, on a server holding data about Veradigm’s customers’ patients and health plan members, and that the stolen information included names, Social Security numbers, phone numbers and medical information. That last point conflicts with Veradigm’s statement that no medical data was involved. Citing a threat-intelligence website, the complaint says a ransomware group called “The Gentlemen” has claimed responsibility. Veradigm’s filing does not mention ransomware or name any group.The complaint was filed the same day as Veradigm’s 8-K and says Veradigm had not yet acknowledged the breach or notified the people affected. It alleges Veradigm did not adequately monitor or secure its systems and would have caught the breach sooner if it had.
A Second Lawsuit: Walker v. Veradigm
Walker v. Veradigm, Inc., No. 1:26-cv-10852, was filed on September 9, 2026 in the same court by Kopelowitz Ostrow P.A. and assigned to Judge Jeffrey I. Cummings. It closely tracks the first complaint: the same alleged September 5 incident, the same categories of data, the same reference to “The Gentlemen” group, the same nationwide class and the same five claims. The plaintiff, who says she gave her information to a Veradigm client to get medical services, also alleges her name and Social Security number were published on the dark web after the breach. Like the first case, it is at the complaint stage.Claims and What the Lawsuit Seeks
The complaint brings claims for negligence, negligence per se, breach of a contract that patients benefited from as third parties, unjust enrichment and a declaratory judgment. It asks for actual and statutory damages, restitution, lifetime credit monitoring and identity theft insurance, a court order requiring stronger data security, and for Veradigm to pay the cost of notice and claims administration.Who Would Be Covered?
The proposed nationwide class is everyone whose personal information was accessed or taken by an unauthorized party in the breach. Because Veradigm works for health care providers, health plans and life sciences companies rather than directly with patients, many people in the class may never have heard of Veradigm. A breach notice from Veradigm or from a provider or plan that uses it would be the clearest sign that someone is included. No class has been certified.What Happens Next
With two nearly identical suits already pending in the same court, a motion to consolidate them before one judge is a likely early step, and more suits may follow. Breach notice letters, when Veradigm or its customers send them, typically state what information was involved and sometimes include an offer of free credit monitoring. There is nothing to file in the lawsuit and no deadline. OCA will update this page if the cases are consolidated, dismissed or settled.Questions
What happened in the Veradigm data breach?
In a September 8, 2026 SEC filing, Veradigm said a third-party vendor was breached and unauthorized people used the vendor’s credentials to reach one Veradigm application programming interface. Veradigm said they obtained personal data of patients of a small number of its customers, in some cases including Social Security numbers, and that no clinical or medical data was involved.
Why would a Veradigm breach affect me if I never used Veradigm?
Veradigm, formerly Allscripts, sells software and data services to health care providers, health plans and life sciences companies. Patients usually deal with those customers, not with Veradigm directly, so people affected by a breach at Veradigm may never have heard of the company.
Does the lawsuit agree with Veradigm about what was taken?
Not entirely. The complaint alleges names, Social Security numbers, phone numbers and medical information were compromised. Veradigm’s SEC filing says Social Security numbers were taken in some cases but that no clinical or medical data was involved. The complaint was filed the same day as Veradigm’s filing.
Can I get money from the Veradigm data breach lawsuit now?
No. The case was filed on September 8, 2026 and is at the complaint stage. There is no settlement, no claim form and no deadline. Money would only be available if the case settles or the plaintiff wins.
Sources
• Class action complaint, Clay v. Veradigm, Inc., No. 1:26-cv-10827 (N.D. Ill., filed September 8, 2026), the source of the allegations above.• The case docket on CourtListener.
• Class action complaint, Walker v. Veradigm, Inc., No. 1:26-cv-10852 (N.D. Ill., filed September 9, 2026).
• Veradigm Inc. Form 8-K, filed September 8, 2026, the source of Veradigm’s description of the incident.
