Epic pauses product development to fix MyChart security bugs that risk patient data

Judy Faulkner, the founder and chief executive of Epic, told Modern Healthcare last month that the pause would likely last six weeks while work continues on safeguarding the company's products. Epic has not disclosed the nature of the bugs. Chief security officer Stirling Martin told The Times that some customer configurations of MyChart could allow outsiders to access patient records without recording any intrusion in the software's logs. Martin did not return TechCrunch's request for comment. He told The Times that the AI model did not say if the bug could be exploited to alter patient records without detection, but argued it was enough of a risk to remediate the issues.

Epic's MyChart software is used to maintain over 320 million patient records across hospitals and doctor's offices across the United States. Epic says it does not have access to customers' medical data: that responsibility falls on healthcare providers like hospitals and doctor's offices. But a bug unknown to Epic could allow hackers to compromise multiple MyChart affected systems located across the United States and raid the data stored within.

It is rare for a company to pause development to fix security bugs, but the advent of AI tools capable of rapidly finding and exploiting security vulnerabilities has led to concerns that attackers could have an easier time stealing data.

Healthcare breaches are increasingly common as hackers seek access to highly sensitive health and medical data, under the assumption that providers would pay to prevent hackers from publishing the information online. A 2024 ransomware attack on Change Healthcare, a health-tech company owned by insurance giant UnitedHealth tasked with handling payments and billing for most Americans, allowed hackers to steal health data on more than 192 million people, the majority of people in the United States. The company paid the hackers twice not to publish the stolen data.

This year, a string of back-to-back data breaches at healthcare and tech companies have affected tens of millions of Americans. This includes medical records stolen during a breach at electronic health data storage giant CareCloud, millions of rows of patient data from pharmaceutical distributor McKesson, and an unspecified amount of stolen data from U.K.-based health tech company Craneware, whose software is used across North America. The Department of Health and Human Services currently lists a breach at dental insurance company DentaQuest affecting 15 million people as the largest healthcare-related data breach of 2026 so far.

Editor's Summary

Epic paused most product development, likely for six weeks, after Anthropic's Mythos cybersecurity model found flaws that could expose MyChart patient records. The company is fixing configurations that might allow undetected access to data held by hospitals and doctors' offices. The pause comes as healthcare data breaches continue to affect tens of millions of Americans.