Cerner

Summary

A breach of a legacy Cerner system exposed personal and medical information of nearly 20 million individuals, including roughly three million residents of one state, with compromised data encompassing Social Security numbers, addresses, and clinical details. The incident affected at least two dozen health systems and potentially dozens of hospitals, prompted extortion demands for cryptocurrency from a single threat actor, and triggered a consolidated federal class-action lawsuit spanning multiple states that also names several provider organizations, with a court ruling that healthcare entities cannot fully delegate data-protection responsibility to an outside vendor.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Oracle Corporation acquired Cerner in 2022 for $28 billion. In 2025, an unauthorized individual gained access to legacy Cerner servers on January 22 that had not yet been migrated to the Oracle Cloud. The breach was identified on March 7, 2025, according to The HIPAA Journal. A notice sent to impacted Oracle customers in late February 2025 stated that Oracle Health learned cybercriminals had gained access to patient information through those legacy servers. Bloomberg reported, citing information released by the Texas attorney general, that the incident compromised personal information belonging to nearly 20 million people. The Texas attorney general’s report, issued October 2, stated that Social Security numbers, addresses, and medical information of almost 20 million people were compromised, including about 3 million Texans. Oracle Health has not publicly disclosed how many Cerner clients were affected or the total number of individuals affected. Becker's Hospital Review reported that at least 29 health systems were impacted, while The HIPAA Journal reported that 80 hospitals may have been affected. The Texas attorney general’s data breach portal showed that Cerner Corp. reported nearly 3 million affected Texans, with exposed data including addresses, Social Security numbers, and medical information. The portal entry was dated October 2, and Oracle Health/Cerner notified affected individuals in Texas by U.S. mail.

Media reports indicated that impacted hospitals received extortion demands related to the breach. Bleeping Computer reported that the extortions came from a single threat actor demanding millions in cryptocurrency. A class action complaint filed in April 2025 by two women in the U.S. District Court for the Western District of Missouri accused Oracle of negligently failing to protect patient data. The complaint alleged that a hacker exfiltrated patient data including names, Social Security numbers, dates of birth, driver’s license numbers, medication details, and diagnostic information. The plaintiffs argued that the breach was a direct result of Oracle’s failure to implement adequate and reasonable cybersecurity procedures and protocols necessary to protect individuals’ private information. They also claimed that Oracle delayed necessary notifications. The lawsuit accused Oracle of violating several federal and state laws, including HIPAA, the Federal Trade Commission Act, and multiple California privacy laws.

Twenty-nine separate class action lawsuits filed across 13 states were consolidated into a single master case in Missouri. The consolidated class action suit also targets eight health systems. In June, a federal judge ruled that the data breach lawsuit against Oracle Health and the eight health systems can move forward. Becker's Hospital Review reported that the court rejected the health systems’ argument that the breach was Oracle Health’s responsibility alone, finding that the providers had not shown their duty to protect patient data was delegable and could not be absolved of liability by contracting it out to a third party. Oracle Health has not publicly responded to the lawsuit and did not respond to a request for comment on the Bloomberg report.

Sources

Sources available to members: 1 source.