Medical records giant Epic pauses product development to fix security bugs that risk patients’ data

Epic, the bundle exertion elephantine that makes the wide utilized MyChart bundle for accessing patients’ aesculapian data, has paused astir of its merchandise improvement arsenic the institution works to support its bundle and systems from cyberattacks.

Judy Faulkner, the laminitis and main enforcement of Epic, told Modern Healthcare past period that the intermission would apt past six weeks portion enactment continues connected “safeguarding” the company’s products, aft a deployment of Anthropic’s frontier cybersecurity exemplary Mythos unearthed information flaws that could let entree to patients’ data.

The institution has not disclosed the quality of the bugs, but its main information serviceman Stirling Martin told the Times that immoderate lawsuit configurations of MyChart could let outsiders to entree diligent records without signaling immoderate intrusion successful the software’s logs.

Martin, who did not instrumentality TechCrunch’s petition for comment, told The Times that the AI exemplary did not accidental if the bug could beryllium exploited to change diligent records without detection, but argued it was capable of a hazard to remediate the issues.

Epic’s wide utilized MyChart bundle is utilized to support implicit 320 cardinal diligent records crossed hospitals and doctor’s offices crossed the United States. Epic says it does not person access to customers’ aesculapian data: that work falls connected healthcare providers similar hospitals and doctor’s offices. But a bug chartless to Epic could let hackers to compromise aggregate MyChart affected systems located crossed the United States and raid the information stored within.

It’s uncommon for a institution to intermission improvement to hole information bugs, but the advent of AI tools susceptible of rapidly uncovering and exploiting information vulnerabilities has led to concerns that attackers could person an easier clip astatine stealing data.

Healthcare breaches are progressively communal arsenic hackers question entree to highly delicate wellness and aesculapian data, nether the presumption that providers would wage to forestall hackers from publishing the accusation online. A 2024 ransomware onslaught connected Change Healthcare, a health-tech institution owned by security elephantine UnitedHealth tasked with handling payments and billing for astir Americans, allowed hackers to bargain wellness information connected much than 192 cardinal people, the bulk of radical successful the United States. The institution paid the hackers twice not to people the stolen data.

This year, a drawstring of back-to-back information breaches astatine healthcare and tech companies person affected tens of millions of Americans. This includes aesculapian records stolen during a breach astatine electronic wellness information retention elephantine CareCloud, millions of rows of patient information from pharmaceutical distributor McKesson, and an unspecified magnitude of stolen information from U.K.-based wellness tech institution Craneware, whose bundle is utilized crossed North America.

The Department of Health and Human Services presently lists a breach astatine dental security institution DentaQuest affecting 15 cardinal radical arsenic the largest healthcare-related information breach of 2026 truthful far.