securityweek.comarticleOracle Health Data Breach Tally Climbs to Nearly 20 Million
New Texas attorney general filings put the toll of the 2025 Oracle Health (Cerner) breach at nearly 20 million affected individuals, far above earlier estimates. The attacker, a lone extortionist known as 'Andrew', used stolen customer credentials to access an old legacy Cerner server not yet migrated to Oracle Cloud and exfiltrated patient data including SSNs and medical records, then demanded cryptocurrency ransom while threatening public leak sites.
TL;DR Oracle Health/Cerner legacy-server breach via stolen credentials now estimated at nearly 20 million victims per Texas AG filing.
Organisations named here
- Change Healthcare
Technologies named here
- Oracle Health Cerner legacy systems
- Cerner
- Oracle Health
Techniques named here
- Use of stolen customer credentials to access server
- Data exfiltration to remote server
- Extortion via public pressure sites
Threat actors named here
- Andrew
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup