MediTrust Health breach exposes 2.1 million patient records via third-party scheduling API

This July 2025 roundup describes a major incident at MediTrust Health, where a previously unknown vulnerability in a third-party scheduling API led to exposure of over 2.1 million patient records.[2] The article highlights healthcare data leakage and supply-chain risk for SMB and mid-market health-tech providers that integrate AI and cloud-based SaaS components into clinical and operational workflows.[2]

The article reports that MediTrust Health suffered a breach exposing 2.1 million patient records due to a previously unknown vulnerability in a third-party scheduling API used in its healthcare workflows.[2] It emphasizes that SMB and mid-market health-tech providers increasingly rely on integrated AI and cloud-based SaaS components, creating significant healthcare data leakage and supply-chain risk.[2] From a RealGround perspective, this incident illustrates how insecure third-party AI/SaaS integrations can compromise protected health information at scale, even when the primary provider’s systems are not directly hacked. Organizations should treat AI and SaaS vendors as critical supply-chain assets, maintain an AI/software bill of materials (SBOM), and continuously assess and monitor third-party APIs for security posture, data exposure paths, and incident response readiness.