Epic Systems, maker of the widely used MyChart patient portal, has paused most product development for about six weeks to fix security vulnerabilities that could expose patient data. The flaws were discovered by Anthropic's frontier cybersecurity model Mythos. The company has not disclosed the exact nature of the bugs, but Chief Security Officer Stirling Martin told The New York Times that certain customer configurations of MyChart could allow outsiders to access patient records without leaving any trace in the software's logs.
The pause is rare for a major software company and reflects growing concern that AI tools can rapidly find and exploit security weaknesses. MyChart maintains more than 320 million patient records across U.S. hospitals and clinics. Epic says it does not hold customer data itself, but a bug unknown to Epic could let hackers compromise multiple MyChart systems and raid the data stored within them.
Healthcare data breaches have become increasingly common. The 2024 ransomware attack on Change Healthcare exposed data on more than 192 million people, and the company paid hackers twice to prevent publication. This year, breaches at CareCloud, McKesson, and Craneware have affected tens of millions of Americans. The Department of Health and Human Services currently lists a breach at dental insurer DentaQuest affecting 15 million people as the largest healthcare-related data breach of 2026 soStrictly follow the user's request. Return only JSON. Ensure valid JSON with no trailing commas. Use double quotes. Escape internal quotes if any. The body contains apostrophes, fine. No newlines outside JSON? We can pretty-print JSON with newlines, that's valid. Ensure no markdown outside JSON. Let's output.```json {