Epic, the software technology giant that makes the widely used MyChart software for accessing patients\u2019 medical data, has paused most of its product development as the company works to protect its software and systems from cyberattacks.<\/p>\n
Judy Faulkner, the founder and chief executive of Epic, told Modern Healthcare<\/a> last month that the pause would likely last six weeks while work continues on \u201csafeguarding\u201d the company\u2019s products, after a deployment of Anthropic\u2019s frontier cybersecurity model Mythos unearthed security flaws that could allow access to patients\u2019 data.<\/p>\n The company has not disclosed the nature of the bugs, but its chief security officer Stirling Martin told The New York Times<\/a> that some customer configurations of MyChart could allow outsiders to access patient records without recording any intrusion in the software\u2019s logs.<\/p>\n Martin, who did not return TechCrunch\u2019s request for comment, told the Times that the AI model did not say if the bug could be exploited to alter patient records without detection, but argued it was enough of a risk to remediate the issues.<\/p>\n Epic\u2019s widely used MyChart software is used to maintain over 320 million patient records across hospitals and doctor\u2019s offices across the United States. Epic says it does not have access<\/a> to customers\u2019 medical data: that responsibility falls on healthcare providers like hospitals and doctor\u2019s offices. But a bug unknown to Epic could allow hackers to compromise multiple MyChart affected systems located across the United States and raid the data stored within.<\/p>\n It\u2019s rare for a company to pause development to fix security bugs, but the advent of AI tools capable of rapidly finding and exploiting security vulnerabilities has led to concerns that attackers could have an easier time at stealing data.<\/p>\n Healthcare breaches are increasingly common as hackers seek access to highly sensitive health and medical data, under the assumption that providers would pay to prevent hackers from publishing the information online. A 2024 ransomware attack on Change Healthcare<\/a>, a health tech company owned by insurance giant UnitedHealth tasked with handling payments and billing for most Americans, allowed hackers to steal health data on more than 192 million people, the majority of people in the United States. The company paid the hackers twice<\/a> not to publish the stolen data.<\/p>\n This year, a string of back-to-back data breaches at healthcare and tech companies have affected tens of millions of Americans. This includes medical records stolen during a breach at electronic health data storage giant CareCloud<\/a>, millions of rows of patient data from pharmaceutical distributor McKesson<\/a>, and an unspecified amount of stolen<\/a> data from U.K.-based health tech company Craneware, whose software is used across North America. <\/p>\n The Department of Health and Human Services currently lists a breach at dental insurance company DentaQuest affecting 15 million people as the largest healthcare-related data breach of 2026 so far.<\/p>\n