Epic Pauses Product Development to Fix Patient Data Bugs

Epic, the software technology giant that makes the widely used MyChart software for accessing patients’ medical data, has paused most of its product development as the company works to protect its software and systems from cyberattacks. According to reporting by TechCrunch on Friday, Oct. 2, 2026, the company is dedicating its focus to system security.

AI Deployment Unearths Software Vulnerabilities

Judy Faulkner, the founder and chief executive of Epic, told Modern Healthcare last month that the pause would likely last six weeks while work continues on safeguarding the company’s products. The pause followed a deployment of Anthropic’s frontier cybersecurity model Mythos, which unearthed security flaws that could allow access to patients’ data. Discussions around automated vulnerability discovery and safety risks have drawn broader regulatory attention, similar to how the FTC investigates OpenAI and Anthropic over AI product safety risks. Enterprise infrastructure security has also been a central theme at technology gatherings, including topics raised when the CNBC AI Forum focuses on enterprise scaling, security, and governance in Dallas.

MyChart Configurations and Intrusion Logs

The company has not disclosed the nature of the bugs, but its chief security officer Stirling Martin told the Times that some customer configurations of MyChart could allow outsiders to access patient records without recording any intrusion in the software’s logs. Martin did not return TechCrunch’s request for comment, but told The Times that the AI model did not say if the bug could be exploited to alter patient records without detection, arguing it was enough of a risk to remediate the issues.

Epic’s widely used MyChart software is used to maintain over 320 million patient records across hospitals and doctor’s offices across the United States. Epic says it does not have access to customers’ medical data, as that responsibility falls on healthcare providers like hospitals and doctor’s offices. However, a bug unknown to Epic could allow hackers to compromise multiple MyChart affected systems located across the United States and raid the data stored within.

Healthcare Sector Ransomware and Industry Breaches

It is rare for a company to pause development to fix security bugs, but the advent of artificial intelligence tools capable of rapidly finding and exploiting security vulnerabilities has led to concerns that attackers could have an easier time stealing data. Healthcare breaches are increasingly common as hackers seek access to sensitive health and medical data under the assumption that providers would pay to prevent hackers from publishing the information online.

A 2024 ransomware attack on Change Healthcare, a health-tech company owned by insurance giant UnitedHealth tasked with handling payments and billing for most Americans, allowed hackers to steal health data on more than 192 million people, representing the majority of people in the United States. The company paid the hackers twice not to publish the stolen data.

This year, a string of back-to-back data breaches at healthcare and technology companies have affected tens of millions of Americans. This includes medical records stolen during a breach at electronic health data storage giant CareCloud, millions of rows of patient data from pharmaceutical distributor McKesson, and an unspecified amount of stolen data from U.K.-based health tech company Craneware, whose software is used across North America. The Department of Health and Human Services currently lists a breach at dental insurance company DentaQuest affecting 15 million people as the largest healthcare-related data breach of 2026 so far.