The ransomware gang breached a "major element" of the healthcare technology supply chain and stole sensitive patient data, according to researchers.