Veradigm Data Breach Lawsuit: New 2026 Suits, Old $10.5M Settlement
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Veradigm, the former Allscripts, makes health-record and billing software for doctors' offices — so your data sat with it because your provider used it. On September 8, 2026 it told the SEC that a vendor's stolen login was used to download patient data, in some cases Social Security numbers. A Veradigm class action was filed the same day. For this new breach there is no settlement, no claim form and no deadline. The $10.5 million Veradigm settlement you may have seen is a different, earlier breach, and its claim window closed in March 2026.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened in the 2026 Breach
In a Form 8-K dated September 8, 2026, Veradigm said that one of its third-party vendors “experienced a cybersecurity incident that impacted certain data associated with a small number of the Company’s customers.” An unauthorized party took credentials from the vendor’s environment to a Veradigm application programming interface and used them to download personal data of patients, “including, in some instances, Social Security numbers.” Veradigm says no clinical or medical data was involved and that the stolen login reached only that one interface.
A ransomware group claimed, in a September 5, 2026 leak-site post, to hold over 3.5 million patient records. That is the group’s own claim; Veradigm has not confirmed the figure. The first complaint alleges the incident occurred on or around September 5, 2026 and that medical information was taken too — which conflicts with the company’s account. These are allegations, not findings.
Case Details
The new cases (2026 breach). Court-tracking records show Clay v. Veradigm, Inc., No. 1:26-cv-10827, filed September 8, 2026, and Walker v. Veradigm, Inc., No. 1:26-cv-10852, filed a day later, both in the U.S. District Court for the Northern District of Illinois. Per the Clay docket, on September 30, 2026 Judge Sharon Johnson Coleman granted an unopposed motion to consolidate the actions and appoint interim class counsel. A consolidated amended complaint is due November 16, 2026; Veradigm’s response is due January 11, 2027. We could not open the dockets directly, so treat these dates as reported.
The earlier case (December 2024 breach). Goodrum, et al. v. Veradigm Inc., No. 1:25-cv-07062, in the same court, ended in a $10.5 million settlement administered by Kroll Settlement Administration (official site: VeradigmDataSettlement.com).
Status: Two Breaches, Two Different Answers
December 2024 breach — settled and paying. The $10.5 million Veradigm settlement received final approval on March 26, 2026, per ClaimDepot’s tracking, and the administrator began issuing payments to approved claimants on June 12, 2026. The claim deadline was March 3, 2026 in the court notice (ClaimDepot reports it was extended to March 16, 2026). Either way it has passed: if you did not file, you cannot file now.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Is Affected
2026 breach: patients of Veradigm’s provider customers whose records ran through the vendor’s interface. Veradigm says affected customers and individuals are being notified, with credit monitoring offered where applicable. The proposed classes are people whose data was exposed; you do not sign up to be in a class. The official count of affected people has not been published.
2024 breach settlement: the class was any living U.S. resident who was sent a notice of the December 2024 incident. Veradigm later put that incident at 2,672,036 people.
Which letter do you have? A notice dated from September 2025 onward that mentions a storage account belongs to the old breach. A notice mentioning a vendor or an API, sent in or after September 2026, belongs to the new one. The letter may carry your doctor’s name rather than Veradigm’s. Keep it either way.
What Each Case Pays
2024 breach (closed for claims): class members who filed could choose up to $5,000 for documented losses or an alternate cash payment estimated at $50, plus two years of medical data monitoring. Cash amounts were subject to pro rata adjustment. Up to one-third of the fund ($2,916,666.67) was sought for attorneys’ fees. You can see how pro rata math works in our payout calculator.
Veradigm Breach Timeline
- 1
December 2024 — First Breach
An attacker uses credentials stolen in a customer’s incident to access a Veradigm storage account. Veradigm learns of it on July 1, 2025.
- 2
September 22, 2025 — Old Breach Notices
Veradigm starts mailing letters about the December 2024 incident. The Goodrum case (1:25-cv-07062) is already pending.
- 3
March 2026 — $10.5M Settlement Closes
Claims close (March 3 per the notice; March 16 per ClaimDepot) and final approval follows on March 26, 2026. Payments begin June 12, 2026.
- 4
September 5, 2026 — Ransomware Claim
A ransomware group posts Veradigm on its leak site, claiming over 3.5 million patient records. Veradigm has not confirmed that number.
- 5
September 8–9, 2026 — 8-K and New Suits
Veradigm discloses the vendor-credential breach to the SEC. Clay (1:26-cv-10827) and Walker (1:26-cv-10852) are filed in Chicago federal court.
- 6
September 30, 2026 — Cases Consolidated
Per the docket, the court consolidates the actions. Consolidated complaint due November 16, 2026; Veradigm’s response due January 11, 2027.
Three Things to Watch For
Two Veradigm breaches, one of them with a real payout, make it easy for imposters to blur the line:
“Claim your Veradigm settlement” for the 2026 breach
The only Veradigm settlement covers the December 2024 breach, and its claim deadline passed in March 2026. Any form asking for your Social Security number to “join” a 2026-breach payout is collecting data, not filing a claim.
Fake Kroll payment messages
Payments on the old settlement went only to approved claimants. A text or email saying you are “owed” money and must pay a release fee or confirm bank details is not from the administrator, which never charges a fee.
Calls quoting the 3.5 million figure
The number comes from a ransomware group’s leak site, not from Veradigm. Callers who use it to sound informed and then ask for your details or a payment for “data removal” are working the panic, not helping.
Veradigm Lawsuit — Questions People Actually Ask
Who is Veradigm, and why do they have my information?
Veradigm, formerly Allscripts, sells electronic health record, practice management and billing software to independent doctors’ offices. If your provider used it, your records were in its systems. Most affected people never dealt with Veradigm directly.
Is there a Veradigm settlement for the September 2026 breach?
No. As of October 2026 the new cases are at the pleading stage. There is no settlement, no fund, no administrator, no claim form and no deadline for the 2026 breach.
What is the $10.5 million Veradigm settlement, then?
It resolves Goodrum v. Veradigm (1:25-cv-07062) over the December 2024 storage-account breach. It received final approval on March 26, 2026, per ClaimDepot, and payments to approved claimants began June 12, 2026. The claim deadline passed in March 2026.
Can I still file a claim in the old settlement?
No. Claims had to be postmarked by March 3, 2026 under the court notice; ClaimDepot reports an extension to March 16, 2026. Both dates have passed. If you filed, questions go to Kroll through the official settlement website.
What data was taken in 2026?
Veradigm says personal data of patients, including Social Security numbers in some instances, and no clinical or medical data. The first complaint alleges medical information was taken as well. Your own notice letter states which fields applied to you.
How many people are affected by the 2026 breach?
Unknown officially. A ransomware group claims over 3.5 million records; Veradigm has not confirmed that, and it described the incident as affecting a small number of its customers. For comparison, the December 2024 breach covered 2,672,036 people.
Do I have to do anything to be in the new Veradigm class action?
No. You are included in a certified class automatically unless you opt out. Nothing has been certified yet, and there is nothing to sign up for. If a settlement comes, a court-appointed administrator will send notice.
What is worth doing right now?
Freeze your credit at all three bureaus — it is free and reversible. Accept the credit monitoring if your letter offers it. Keep the notice and envelope. Watch your insurer’s explanation-of-benefits statements for care you never received.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Settlements still accepting claims, with deadlines
Data Breach Settlement Calculator
Estimate what a breach settlement could pay per person
Settlement Payout Calculator
How pro rata payouts shrink or grow with claim rates
Change Healthcare Data Breach
Another health-IT vendor breach and where its cases stand