3.5 Million Health Records Claimed Stolen

Veradigm, a Chicago-based company that provides electronic health record systems to thousands of hospitals and doctors worldwide, has disclosed that attackers broke into a third-party vendor's systems and used stolen credentials to access a Veradigm API (application programming interface — a connection point that lets external software communicate with a company's systems), according to The Record.

The attackers used that access to download copies of patient data, including Social Security numbers in some cases. No clinical or medical records were taken. Veradigm says the intrusion was limited to that specific interface and did not reach its broader networks or databases.

The Gentlemen ransomware gang has since claimed responsibility, posting on its leak site that it stole the health records of 3.5 million patients. The group has been active since last autumn and has previously targeted healthcare companies Nutex and AnMed. Veradigm has reported the incident to law enforcement and an investigation is ongoing.

This is not Veradigm's first rodeo. The company, formerly known as Allscripts, was hit by the SamSam ransomware gang in 2019 and reported a separate breach involving over 2.6 million people as recently as December 2025.

What you should do: If you have ever been a patient at a hospital or clinic in the US, it is worth assuming your data may have passed through a health records system at some point. Check whether you are eligible for free credit monitoring through any breach notifications you receive, and consider placing a free credit freeze with the three major credit bureaus (Equifax, Experian, TransUnion) to prevent anyone opening accounts in your name.

Security researchers at Noma Labs have identified a new attack method they are calling "workflow identity hijacking," according to Dark Reading.

Here is how it works: many companies now use automated AI pipelines that read incoming requests — from a support inbox, a web form, or a shared document — and take actions on the company's behalf. The problem is that these pipelines run with high-level permissions regardless of who sent the original request. An attacker can send a message through a public-facing entry point asking the AI to fetch sensitive internal data, and the system obliges, using its own privileged access to do so.

Nobody manipulated the AI. The model did exactly what it was designed to do. The flaw is that the system never checked whether the person making the request had permission to receive what they asked for.

What you should do: If your organisation uses AI-powered workflows that connect to internal systems, ask your IT team whether those pipelines enforce the permissions of the requesting user, not just the system running them.

What Cisco Secure Firewall Management Center is: A centralised management platform used by network administrators to control and monitor Cisco firewall devices across an organisation's infrastructure.

What it is: An authentication bypass vulnerability (a flaw that lets an attacker skip the login process entirely) that allows an unauthenticated remote attacker to execute scripts on the device and gain root access — the highest level of system control — to the underlying operating system.

Who's at risk: Any organisation running an unpatched instance of Cisco Secure FMC that is reachable over a network. Cisco Talos confirms active exploitation in the wild by multiple threat groups, including a ransomware operator and suspected state-sponsored actors. Read the full Talos advisory here.

CVSS: 10.0 (Critical) — patch today. This is the highest possible severity score.

Root cause: The software fails to properly verify a user's identity before allowing access to privileged functions. An attacker can interact with authenticated endpoints without presenting valid credentials, because the application's authentication logic does not enforce the check at the point of execution.

Attack vector: An attacker sends a crafted request directly to the FMC interface without logging in. The application processes the request as though it came from an authorised user, allowing the attacker to execute scripts and establish root-level access. From there, observed post-exploitation activity includes deploying web shells (persistent backdoors hidden in web server files), harvesting stored credentials, and in one confirmed case, deploying a variant of the Cyclops Blink malware previously linked to Russian state actors.

A second related vulnerability, CVE-2026-20316 (CVSS 5.3, Medium), has been used alongside this flaw to further elevate attacker privileges — patch that one too.

Detection strategies: Look for unexpected processes or unfamiliar JAR files in your Tomcat webroot directory. Review authentication logs for access to privileged endpoints from unauthenticated sessions. Monitor for outbound connections to unusual external IP addresses initiated by the FMC process.

Recommended actions:

1. Apply Cisco's available hotfix for CVE-2026-20079 immediately — do not wait for the comprehensive hardening release scheduled for the week of 14 September.
2. Restrict FMC management interface access to trusted IP ranges only.
3. Review FMC access logs for signs of compromise before and after patching.

An API key (a credential that lets one piece of software authenticate with another) left in a public code repository is a gift to attackers. Bots scan public repositories constantly, and the majority of exposed keys remain active long after they are found.

A security researcher has proposed an open standard called ORKS (Open Revocable Key Standard), detailed at Security Week, that would allow anyone who finds a leaked key to destroy it immediately by submitting it to a revocation endpoint — no account or authentication required.

The standard is not yet widely adopted, but the underlying lesson is actionable right now: if your team uses API keys, set a reminder to rotate them on a schedule and audit whether any have been committed to public repositories using a tool like GitHub Secret Scanning.

The FBI has released a 17-page public cybersecurity strategy, its first ever, according to The Record. The document outlines four pillars: imposing costs on attackers, supporting victims, working with private industry, and building the FBI's own digital capabilities. The bureau says it will pursue more frequent disruptive operations rather than waiting for large-scale joint actions a handful of times a year. For everyday users, this signals a more aggressive federal posture toward ransomware gangs and state-sponsored hackers.