MediTrust Health Breach Exposes 2.1 Million Patient Records via Third‑Party AI-Linked Scheduling API

MediTrust Health, a North American health‑tech provider, suffered a major data breach after a previously unknown vulnerability in a third‑party scheduling API exposed over 2.1 million patient records, including sensitive demographic and treatment data.[1] The incident highlights healthcare AI and SaaS supply chain risk, where embedded APIs and services used by startups and SMBs can become high‑impact data leakage points.[1]

The article reports that MediTrust Health suffered a breach affecting 2.1 million patient records because of a previously unknown vulnerability in a third‑party, AI‑linked scheduling API embedded in its healthcare SaaS stack.[1][3] Exposed data included sensitive demographic and treatment information, demonstrating how interconnected healthcare APIs and external services can serve as high‑impact data leakage points when not continuously monitored and governed.[1][6] From a RealGround perspective, this incident exemplifies AI supply chain risk: organizations relying on AI-enhanced SaaS and third‑party APIs need SBOM‑style visibility into all embedded services, real‑time API security monitoring, and vendor security baselines to prevent similar compromises.[1][6] Practically, healthcare and SaaS teams should implement stricter third‑party API governance, continuous vulnerability scanning, and contractual security requirements for AI-linked vendors to reduce systemic exposure across their AI supply chain.[1][6]