Oracle Health

Summary

Oracle Health experienced a breach of its legacy Cerner servers that exposed personal information including Social Security numbers, addresses, and medical details for nearly 20 million individuals, with about three million of those affected residing in Texas. The intrusion was discovered after unauthorized access had been present for several weeks, leading to extortion demands from a threat actor seeking cryptocurrency payments. At least twenty‑nine health systems and possibly up to eighty hospitals were impacted, prompting multiple class‑action lawsuits that allege negligent failure to protect patient data and violations of HIPAA and state privacy statutes. A federal judge has allowed the consolidated litigation to proceed, rejecting arguments that the healthcare providers could delegate their data protection responsibility to the vendor.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 22, 2025, an unauthorized individual gained access to Oracle Health’s legacy Cerner servers that had not yet been migrated to the Oracle Cloud. Oracle Health learned of the intrusion in late February 2025 after receiving a notice to impacted customers. The breach was identified on March 7, 2025, according to the HIPAA Journal. After discovery, affected hospitals received extortion demands from a single threat actor seeking millions in cryptocurrency, as reported by Bleeping Computer.

The Texas attorney general’s office released a report on October 2, 2025, stating that Oracle Health disclosed that Social Security numbers, addresses, and medical information of nearly 20 million people were compromised, including about 3 million Texans. Cerner Corp. reported nearly 3 million affected Texans in the Texas attorney general’s data breach portal, with the same categories of data exposed. Becker's Hospital Review indicated that at least 29 health systems were impacted by the breach, while the HIPAA Journal noted that up to 80 hospitals may have been affected. The compromised data included names, dates of birth, driver’s license numbers, medication details, and diagnostic information, as alleged in the class‑action complaint.

In April 2025, two women filed a class‑action lawsuit in the U.S. District Court for the Western District of Missouri, accusing Oracle Health of negligently failing to protect patient data and violating HIPAA, the Federal Trade Commission Act, and several California privacy laws. The lawsuit alleged that the breach resulted from Oracle’s failure to implement adequate cybersecurity procedures and that the company delayed necessary notifications. By June 2025, twenty‑nine separate class actions filed across thirteen states were consolidated into a single master case, which also named eight health systems as defendants. A federal judge ruled that the consolidated lawsuit could proceed, rejecting the health systems’ argument that liability could be delegated to Oracle Health and stating that providers could not be absolved of responsibility by contracting out data protection. Oracle Health has not publicly responded to the lawsuit or to requests for comment on the Bloomberg report detailing the breach.

Sources

Sources available to members: 1 source.