Oracle Health data breach possibly compromised millions of patients' data

Oracle Health, a US-based, multinational provider of health information technology platforms and services, suffered a significant data security incident that possibly compromised the sensitive personal information of millions of individuals.

 

Formerly known as Cerner, Oracle Health is a healthcare software services provider offering Electronic Health Records (EHR) and business operations systems to hospitals and healthcare organisations across the country. In 2022, Cerner merged with Oracle Health and migrated its systems to Oracle Cloud.

 

While the healthcare service provider did not disclose the incident publicly, BleepingComputer reported that it reviewed private communications sent by the company to impacted clients to confirm that their data records were stolen as a result of a cyber attack.

 

In the notice sent to affected healthcare providers, Oracle Health said that on February 20, it became aware of a data security incident involving legacy Cerner data migration servers.

 

“We are writing to inform you that, on or around February 20, 2025, we became aware of a cybersecurity event involving unauthorised access to some amount of your Cerner data that was on an old legacy server not yet migrated to the Oracle Cloud,” reads the notice. 

 

The company added that around January 22, the threat actor who infiltrated the legacy server used compromised customer credentials and copied data to a remote server. This stolen data “may” include patient information from electronic health records.

 

Oracle Health said it will not notify affected patients directly and that it is the responsibility of the hospitals to determine whether the stolen data violates HIPPA laws and if they are required to send notifications.

 

The healthcare services provider did not disclose whether the threat actor deployed a ransomware and encrypted its systems, or did they simply infiltrate the legacy server to steal sensitive data.