Medical records giant Epic has paused product development to fix a security vulnerability that could jeopardize patient data.

Epic is a software giant whose MyChart platform is widely used for accessing patient medical data. The company has paused most product development to safeguard its software and systems against cyberattacks.

Epic founder and CEO Judy Faulkner told Modern Healthcare last month that security vulnerabilities—potentially allowing unauthorized access to patient data—were identified in the company’s products following the deployment of Mythos, a cutting-edge cybersecurity model from Anthropic. Consequently, operations were paused for a period expected to last six weeks while the company works to “secure” its products.

While the company has not disclosed the specific nature of the vulnerabilities, its Chief Security Officer, Sterling Martin, told The New York Times that certain customer configurations of MyChart could allow outsiders to access patient records without leaving a trace of the intrusion in the software logs.

Martin did not respond to TechCrunch’s request for comment, but he told The Times that while the AI ​​model did not specify whether the vulnerability could be exploited to alter patient records undetected, he deemed the risk significant enough to warrant corrective action.

Epic’s widely used MyChart software manages over 320 million patient records for hospitals and clinics across the United States. Epic maintains that it does not have access to its customers’ medical data; that responsibility lies with healthcare providers such as hospitals and clinics. However, a previously undetected vulnerability could potentially allow hackers to breach multiple affected MyChart systems nationwide and steal the stored data.

It is rare for a company to halt development to address security vulnerabilities; however, the emergence of AI tools capable of rapidly identifying and exploiting such flaws has raised concerns that attackers could find it easier to steal data.

Healthcare data breaches are becoming increasingly frequent as hackers target highly sensitive health and medical information, banking on the assumption that providers will pay ransoms to prevent the data from being leaked online. In 2024, Change Healthcare—a health-tech company owned by insurance giant UnitedHealth Group that processes payments and billing for the majority of Americans—was hit by a ransomware attack. This attack resulted in the theft of health data belonging to over 192 million people—representing the vast majority of the U.S. population. The company paid ransoms to the hackers twice to prevent them from releasing the stolen data.

This year has seen a succession of data breaches at healthcare and technology companies, affecting tens of millions of Americans. These incidents include the theft of medical records from electronic health data giant CareCloud, the compromise of millions of patient records at pharmaceutical distributor McKesson, and a massive data theft at the UK-based health-tech firm Craneware, whose software is widely used across North America.

The U.S. Department of Health and Human Services currently lists the data breach at dental insurer DentaQuest—which affected 15 million people—as the largest healthcare-related data breach of 2026 to date.