Epic halts product work to patch flaws threatening patients' records

Epic, the software giant behind the widely used MyChart system for accessing medical data, has paused most of its product development to shore up its software and systems against cyberattacks.

Founder and chief executive Judy Faulkner told Modern Healthcare that the pause would likely run about six weeks while engineers work on "safeguarding" the company's products. The trigger was a deployment of Anthropic's frontier cybersecurity model, Mythos, which unearthed flaws that could expose patient data.

What the bugs could do

Epic has not described the nature of the flaws. Chief security officer Stirling Martin told The New York Times that some customer configurations of MyChart could let outsiders reach patient records without leaving any trace in the software's logs. The AI model, he said, could not determine whether the bug might also allow records to be altered undetected — but the risk alone was enough to warrant fixing. Martin did not respond to TechCrunch's request for comment.

MyChart is used to maintain more than 320 million patient records across hospitals and doctors' offices in the United States. Epic stresses that it does not have access to customers' medical data — that falls to the healthcare providers themselves. Yet a flaw unknown to Epic could have opened a path for attackers to compromise many deployed systems across the country.

Why the move stands out

It is rare for a company to halt development to fix security bugs. But the arrival of AI tools able to rapidly find and exploit vulnerabilities has raised fears that attackers, too, may have an easier time stealing data.

Healthcare breaches are growing more common, with thieves of highly sensitive medical data betting that organizations will pay to keep it off the internet. A 2024 ransomware attack on Change Healthcare — the UnitedHealth-owned firm that handles payments for most Americans — led to the theft of data on more than 192 million people; the company paid the hackers twice.

This year, a run of breaches at health and tech companies has hit tens of millions of Americans, including CareCloud, pharmaceutical distributor McKesson, and the U.K.-based Craneware. The U.S. Department of Health and Human Services currently lists a breach at dental insurer DentaQuest, affecting 15 million people, as the largest healthcare-related data breach of 2026 so far.

Source: TechCrunch