INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Oracle Experiences Nearly 20 Million Records Compromised in Data Breach

| 2026-10-08 08:23 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
A nearly 20 million-person healthcare data breach occurred in the United States, with the incident involving unauthorized access to Cerner systems by an individual threat actor known as 'Andrew'. The attack is believed to have taken place between January 22 and April 1, 2025. Oracle Health Data Breach Tally Climbs reported that nearly 20 million people's personal and medical information was compromised in the breach, which would make it one of the largest healthcare data breaches on record in the US if confirmed. The extortion attempts against affected hospitals were carried out by 'Andrew', who had not claimed links to any established ransomware or extortion gang, and demanded millions of dollars in cryptocurrency from victims.
Technical Mitigations AI-generated
• Patch Cerner systems to the latest version (Cerner 2022 R1) to prevent exploitation of known vulnerabilities. • Implement multi-factor authentication for all users, including those with access to legacy servers not yet migrated to Oracle Cloud. • Monitor public websites created by threat actors like 'Andrew' and block any suspicious activity related to data leaks or sales.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA healthhealth
Incident Timeline
‎June 2022
Threat actors exploited a vulnerability in Cerner's EHR system, which was subsequently acquired by Oracle as part of the $28.3 billion deal in June 2022.
organisation EHR
Cerner, an electronic health record (EHR) vendor, became part of Oracle in June 2022, after a deal that valued the company at roughly $28.3 billion.
organisation Oracle
Cerner, an electronic health record (EHR) vendor, became part of Oracle in June 2022, after a deal that valued the company at roughly $28.3 billion.
organisation Oracle Health
The business now operates as Oracle Health.
‎January 22, 2025
An individual threat actor known as 'Andrew' used stolen customer credentials to access an Oracle server and copy data to a remote server after January 22, 2025.
industry Health
General Document Context
organisation BleepingComputer
Sources told BleepingComputer at the time that the extortion attempts against affected hospitals came from an individual threat actor known as ‘Andrew’.
organisation Breach
Breach notifications filed in South Carolina and Washington list roughly 283,000 and 69,000 affected residents, respectively.
‎February 20, 2025
Threat actors used an unspecified method to target Oracle Health, resulting in the exposure of nearly 20 million individuals' personal and medical information.
industry Health
General Document Context
organisation Change Healthcare
Only a handful of reported incidents were bigger, including the 2024 ransomware attack on Change Healthcare , which affected 192.7 million people.
organisation Social Security
“The personal information involved in this incident may have included your name, Social Security number, and information included within patient medical records, such as medical record numbers, doctors, diagnoses, medicines, test results, images, care and treatment,” the letter reads.
‎March 2025
Threat actors used unauthorized access to an old legacy server not yet migrated to the Oracle Cloud to target Cerner data.
‎April 1, 2025
Threat actors used undetermined methods to breach Oracle's health data, resulting in nearly 20 million records exposed between January 22 and April 1, 2025.
industry Health
General Document Context
‎2025/10/08
Threat actors used a cyberattack to target Oracle Health's legacy Cerner systems, resulting in the compromise of nearly 20 million people's personal and medical information.
organisation Oracle Health’s
The personal and medical information of nearly 20 million people was compromised in a cyberattack on Oracle Health’s legacy Cerner systems early last year, Bloomberg reported, citing a report from the Texas attorney general.
general_metric 20 people
The personal and medical information of nearly 20 million people was compromised in a cyberattack on Oracle Health’s legacy Cerner systems early last year, Bloomberg reported, citing a report from the Texas attorney general.
‎January 22
Threat actors used an unspecified vector to breach Oracle's health data between January 22 and April 1, 2025.
‎October 2
Cerner's entry on the Texas attorney general's data breach portal reported nearly 3 million Texans were affected by a data breach.
tactic Data Breach
Cerner’s entry on the Texas attorney general’s data breach portal, published on October 2, lists 2,992,244 affected Texans.
general_metric 2,992,244 affected Texans
Cerner’s entry on the Texas attorney general’s data breach portal, published on October 2, lists 2,992,244 affected Texans.
‎2026/10/08
Oracle reported a nearly 20 million records breached in its health data system.
organisation Oracle Health Data Breach Tally Climbs
Oracle Health Data Breach Tally Climbs to Nearly 20 Million.
Intelligence Sources
SecurityWeek 2026-10-08