CHRISTUS Health

Summary

A cyberattack on Oracle Health exposed the personal data of nearly 20 million people, including names, Social Security numbers, addresses, medical diagnoses, medicines, and test results. Christus Health, a Texas nonprofit healthcare system among at least 29 affected hospital and health systems, said compromised patients would receive notification letters and complimentary credit monitoring and identity protection services. The breach occurred when attackers used compromised credentials to access two older Cerner servers before patient data could be migrated to Oracle’s cloud infrastructure.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

A cyberattack against Oracle Health exposed the personal data of nearly 20 million people, according to a report from the Texas attorney general’s office. The breach happened after January 22, 2025, and Oracle alerted some customers about it in March of that year. Christus Health, a nonprofit healthcare system in Texas, was among the organizations affected by the data theft. The attackers targeted older Cerner servers before the data stored on them could be migrated to Oracle’s cloud storage service. The hacker compromised customer credentials and used them to access two Cerner servers and then copied patient data from those servers. Oracle Health is a division of Oracle, which acquired healthcare technology company Cerner for $28.3 billion in June 2022. CyPro, a UK cybersecurity firm, noted that at least 29 hospital and health systems said they had been affected by the breach. Of the nearly 20 million people affected, 3 million were Texans. Christus Health and Tri-City Medical Center in California were both identified as affected by the breach. Neither Oracle nor the Texas attorney general initially specified which hospitals, clinics or other healthcare providers were affected by the data theft.

Christus Health said stolen patient data could include names, Social Security numbers, doctors, diagnoses, medicines and test results. Oracle disclosed to investigators that the personal information taken by the attacker included Social Security numbers, addresses and medical information. Christus Health stated that patients whose data was compromised would receive letters about the incident. The organization also said affected patients would be offered a complimentary two-year membership to credit monitoring and identity protection services. The breach affected patient records held on two legacy Cerner servers rather than Oracle’s cloud infrastructure. Oracle stated that its cloud infrastructure was unaffected by the attack. The compromised credentials allowed the attacker to access the two Cerner servers and copy patient data from them. Christus Health is one of the healthcare customers in Texas and other states that use Oracle healthcare services.

Sources

Sources available to members: 1 source.