Epic, whose MyChart systems hold over 320 million patient records, paused product work, likely for six weeks, to fix flaws

Epic, the company behind the MyChart patient portal, has paused most of its technology development to harden its software against cyberattacks. Founder and chief executive Judy Faulkner said the security work would take about six more weeks, and the trigger was a set of flaws that could expose patient data. Epic has not said what the bugs are.

The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.

Get TLDR →

We may earn a commission if you sign up.

MyChart holds more than 320 million patient records across hospitals and doctors’ offices in the United States. A company that sits on that much medical history rarely stops building new features, and the decision, reported on Oct. 2, 2026, stands out in an industry where breaches have become routine and where a single vendor’s weakness can reach thousands of providers at once.

Faulkner’s six-week pause

Faulkner told Modern Healthcare that the work would likely take six weeks and would concentrate on “safeguarding” Epic’s products. She spoke at the magazine’s Leadership Summit on Sept. 22, according to Becker’s Hospital Review, which quoted her saying Epic had “paused most technology development” to put security work across hundreds of projects first. Six weeks was her estimate of the duration, not a fixed end date.

The pause is also less total than the phrase suggests. Fierce Healthcare reported that Faulkner said product development would continue at a slower pace during the security push, and an Epic spokesperson told the outlet the development roadmap presented at the company’s August users meeting had not changed. The two statements sit awkwardly together, and Fierce did not reconcile them.

The Mythos finding and the missing audit trail

According to TechCrunch’s report, the pause followed Epic’s deployment of Mythos, a frontier cybersecurity model from Anthropic. Epic’s chief security officer, Stirling Martin, told The New York Times that certain customer configurations of MyChart could let outsiders reach patient records without any intrusion being recorded in the software’s logs. Becker’s added that Martin said the AI found potential vulnerabilities that Epic’s expert developers had missed.

That detail is the unsettling part. Security teams usually learn about a break-in from the trail it leaves, and a flaw that leaves none would let an intruder read records for as long as the hole stayed open, with nothing for hospital staff or auditors to review afterward. Martin said the model did not tell Epic whether the bug could also be used to alter records without detection, but he argued the exposure alone justified remediation. He did not return TechCrunch’s request for comment.

Epic has declined to describe the bugs. Outsiders therefore cannot judge how many hospitals run the affected configurations, or whether any attacker found the weakness first. What is on the record is narrower: a vendor’s own AI-assisted review found a class of problem serious enough to redirect its engineering teams for weeks, and Martin told customers at the August meeting to expect a higher-than-usual number of urgent security fixes.

Epic confirmed at the August meeting that it takes part in Anthropic’s Project Glasswing and relies heavily on Claude Mythos, an unreleased model, according to Becker’s. Martin also told attendees that the traditional 30-day patching goal is no longer enough, and Baptist Health South Florida’s chief digital and information officer, Sha Edathumparampil, said Epic gave self-hosted hospitals guidance to speed up patching. For health systems, the practical result is faster and more frequent updates to install.

Who holds the data

Epic says it does not have access to its customers’ medical data, which is the responsibility of the healthcare providers that run its software. TechCrunch notes, though, that an unknown bug in widely deployed software could still let hackers compromise many provider systems at once and take what those systems store. The division of responsibility protects Epic legally, but it does not change what a patient stands to lose.

MyChart’s name is also a draw for criminals who have nothing to do with the platform’s code. Becker’s tracked more than 40 health systems that had warned patients by early September about fake “MyChart Medicare Kit” messages, and Epic told the outlet that MyChart’s own security was unaffected and that scammers were exploiting the brand’s popularity. Epic also joined four health systems in a January lawsuit against Health Gorilla alleging that nearly 300,000 patient records were obtained improperly through data exchanges, which Health Gorilla denies.

The stakes are visible in recent history. The 2024 ransomware attack on Change Healthcare ultimately affected about 190 million people, according to a TechCrunch timeline built on the company’s own January 2025 confirmation, and UnitedHealth confirmed it paid a ransom. This year, CareCloud confirmed to federal regulators that hackers stole data on more than 3.75 million people, including Social Security numbers and medical information, from its Amazon Web Services account.

HHS lists a DentaQuest breach affecting 15 million people as the largest healthcare breach of 2026 so far, and CareCloud ranks fifth. A pause at the vendor that touches 320 million records is a bet that fixing flaws before attackers find them costs less than any of those incidents.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

The day in tech, in one email: Get TLDR →

We may earn a commission if you sign up.