Tri-City Medical Center

Summary

A cyberattack against Oracle Health exposed the personal data of nearly 20 million people, including patients at Tri-City Medical Center in California. Attackers used compromised credentials to access two older Cerner servers before cloud migration and copied patient information such as names, Social Security numbers, medical diagnoses, medicines, and test results. The incident affected at least 29 hospital and health systems, with three million individuals in Texas among those impacted.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

A cyberattack against Oracle Health last year exposed the personal data of almost 20 million people, according to a report from the Texas attorney general's office cited by Bloomberg. Oracle Health is a division of Oracle, which acquired the healthcare technology company Cerner for $28.3 billion in June 2022. The breach happened after January 22, 2025, and Oracle alerted some customers about it in March of that year. The personal information taken by the attacker included Social Security numbers, addresses, and medical information, as Oracle disclosed to investigators. The cybersecurity breach occurred after attackers targeted older Cerner servers before the data stored on them could be migrated to Oracle's cloud storage service. According to the UK cybersecurity firm CyPro, the hacker compromised customer credentials and used them to access two Cerner servers and then copied patient data from those servers. Neither Oracle nor the Texas attorney general specified which hospitals, clinics, or other healthcare providers were affected by the data theft. Oracle told its customers that its cloud infrastructure was unaffected, but data held on the two legacy servers was sufficient to expose information potentially belonging to millions of patients.

Of the nearly 20 million people affected, 3 million were Texans. CyPro noted that at least 29 hospital and health systems said they had been affected by the breach. Tri-City Medical Center in California was among the organizations affected. Christus Health, a nonprofit healthcare system in Texas, and Tri-City Medical Center both stated that stolen patient data could include names, Social Security numbers, doctors, diagnoses, medicines, and test results. The Texas attorney general's office released a report on the breach. CNET reached out to both the Texas attorney general's office and Oracle, but representatives did not immediately respond.

Sources

Sources available to members: 1 source.