Threat Pulse 62High
Oracle Health (Cerner) legacy server breach now counted at 19.9 million patients
Severity 8ResolvedreportedHealthcareCredentials and personal data

State attorney general filings published in October put the 2025 Oracle Health breach at about 19.9 million patients nationwide. An attacker used stolen customer credentials on a legacy Cerner server between January and April 2025 and later extorted hospitals under the name Andrew. Exposed data includes SSNs, diagnoses, prescriptions, test results and images.

What to do: Incident dates to 2025; notifications ongoing; Oracle has not confirmed the national total.

· 34 days ago · 19,929,149 patients per state filings · Fox News / CyberGuy
SourcesFox News / CyberGuy
Why this score

Nearly 20 million patients (impact 4), completed theft with extortion (exploitability 2), healthcare as the primary target (criticality 2).

Back to the board

Updated Nov 5, 01:48 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.