Ransomware gang uses new zero-day to steal data on 1 million patients