Oracle Health (formerly Cerner)

Oracle Health, the hospital records business Oracle bought when it acquired Cerner, had patient data stolen from old Cerner data-migration servers in early 2025. According to BleepingComputer, an attacker used stolen customer login credentials to get into the legacy servers some time after January 22, 2025; Oracle says it learned of it around February 20, and multiple hospitals were then extorted for millions of dollars in cryptocurrency. Oracle did not announce the breach publicly; it sent private notices to hospital customers and left the decision whether to notify patients under HIPAA to the hospitals. Separately, Oracle Health's records system has a documented patient-safety record at the Department of Veterans Affairs: VA's Inspector General found in July 2022 that the new system sent 'thousands of orders for medical care to an undetectable location' (the 'unknown queue'), linked that flaw to 149 patient-harm events, and concluded Cerner failed to tell VA staff the queue existed. As of February 2026 VA says the system is live at six VA medical centers.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-10-15

Primary source. www.bleepingcomputer.com/news/security/oracle-health-breach-compromises-patient-data-at-us-hospitals/ — Unverified - heuristic first draft.

Arbitration

No direct patient agreement with Oracle Health for the hospital EHR; oracle.com website terms only. Patient-portal terms not verified this pass.

Data sharing

Holds and processes hospital EHR data for its customers; Oracle's 10-K says it processes sensitive health sciences data including patient health information. Oracle runs a Life Sciences health-research privacy policy (last updated Jan 29, 2025) covering research participants and survey data; Oracle's Learning Health Network (marketed under Oracle Life Sciences) tells participating health systems they can 'leverage a network of de-identified data' and that 'providers and researchers can access and share robust, anonymized data', with members able to 'generate revenue by participating in funded clinical trials'; whether Oracle sells or licenses de-identified EHR data to commercial life-sciences buyers was not confirmed. Oracle Health's information-sharing page routes patient record requests to providers or patient portals and has a form for information-blocking EHI requests.

Contacts

Privacy contact. Global Data Protection Officer, Oracle Corporation, Willis Tower, 233 South Wacker Drive, 45th Floor, Chicago, IL 60606; web form https://www.oracle.com/legal/data-privacy-inquiry-form/

Legal notice. Oracle Corporation, 2300 Oracle Way, Austin, TX 78741 (principal executive office per SEC filings)

Mailing address. Not recorded.