Cerner data breach 2025: what happened and what to do

Cerner is the electronic health record company that Oracle bought in 2022, now sold as Oracle Health. In early 2025 an attacker got into old Cerner servers that were still in use and copied patient data to a remote server.

What happened

Oracle's notice to customers says the attacker used compromised customer credentials and got in sometime after January 22, 2025. Oracle said it learned of the event around February 20, 2025. BleepingComputer reported the breach in late March 2025, citing sources who said patient data had been stolen, although Oracle's notice only said the data "may" have included electronic health record information. Bloomberg reported that the FBI was investigating.

Oracle reportedly told affected hospitals that they would decide whether HIPAA required notifying patients. That is why notices reached people through their own provider, and why the breach shows up in state and federal listings under the Cerner name.

What the official filings say

Cerner reported to the US Department of Health and Human Services that a cyberattack compromised the protected health information of 501 individuals. HHS lists the cause as unauthorized access, and notes that its investigation closed because Cerner is no longer a covered entity after the Oracle acquisition. The notice also appeared on the California and Washington Attorney General lists in 2025. HHS only lists breaches of 500 people or more, and 501 is the number on this one filing. Press reports describe patient data stolen from several US hospitals, and Oracle hasn't published a total, so treat 501 as what one filing says, not as the size of the whole incident.

What was exposed

Protected health information means details tied to your care. Records held in a health record system can include your name, contact details, date of birth, insurance information and treatment history. Oracle hasn't published a full list of fields, so what applies to you depends on the letter you get from your provider.

What that lets criminals do

Medical data is useful for more than one kind of fraud. A name, date of birth and insurance details can be used to bill for care you didn't get, or to get prescriptions in your name. The same details make phishing believable: a message that quotes your real clinic or a real procedure doesn't look like spam. Unlike a password, your medical history can't be changed afterwards.

What to expect now

If your provider used Cerner systems, look for a letter from the provider, not from Oracle. It will say what was involved in your case and whether free credit monitoring is offered. If you didn't get one, you can ask your provider's privacy office. Keep the letter: it is your record of what was involved, and you may need its date later.