Oracle Health Breach May Have Exposed Data of Nearly 20 Million People
Summary
A Texas attorney general report cited by Bloomberg puts the Oracle Health breach at nearly 20 million people. The attacker reportedly used stolen customer credentials to access legacy Cerner data and copied it to a remote server.
Key points
- The reported breach involved Oracle Health’s legacy Cerner systems and may have affected nearly 20 million people.
- Oracle said evidence suggested an attacker used stolen customer credentials to access a legacy server after January 22, 2025, and copied data to a remote server.
- Oracle began notifying healthcare customers in March 2025; it has not publicly confirmed the total number affected.
- The compromised information may have included names, Social Security numbers, and medical records, including diagnoses, medications, test results, and treatment details.
- An individual threat actor known as Andrew reportedly sought millions of dollars in cryptocurrency and used public websites to pressure affected hospitals.
- State filings list about 2.99 million affected Texans, 283,000 South Carolina residents, and 69,000 Washington residents.
Article Details
- Victim Organization
- Oracle Health (formerly Cerner)
- Incident Type
- Unauthorized access to a legacy Cerner server and copying of data to a remote server
- Incident Date
- 2025-01-22
- Disclosure Date
- 2025-03-01
- Data Types Exposed
- Names
- Social Security numbers
- Medical record numbers
- Doctors
- Diagnoses
- Medicines
- Test results
- Images
- Care and treatment information
- Affected Records
- Nearly 20 million people, according to Bloomberg citing a report from the Texas attorney general; Oracle has not publicly confirmed this figure. State filings include 2,992,244 affected Texans, roughly 283,000 South Carolina residents, and 69,000 Washington residents.
- Operational Impact
- Personal and medical information was compromised. No operational disruption is reported.
- Ransom Or Extortion
- Sources told BleepingComputer that an individual threat actor known as Andrew made extortion attempts against affected hospitals, demanding millions of dollars in cryptocurrency and threatening to leak or sell the stolen data. The actor reportedly set up public websites about the breach to pressure victims.
- Claim Status
- alleged
Threat Actors
Vendors
Products
Cernerinformation of nearly 20 million people was compromised in a cyberattack on Oracle Health’s legacy Cerner systems early last year, Bloomberg reported, citing a report from the Texas attorney general.Oracle Cloudaccess to some amount of your Cerner data that was on an old legacy server not yet migrated to the Oracle Cloud,” its notice read.Oracle HealthThe personal and medical information of nearly 20 million people was compromised in a cyberattack on Oracle Health’s legacy Cerner systems early last year, Bloomberg reported, citing a report from the Texas attorney