Oracle Health breach compromises patient data at US hospitals

Oracle Health (formerly Cerner) experienced a breach of legacy data migration servers discovered around February 20, 2025, in which an attacker using compromised customer credentials copied patient data from un-migrated systems; multiple US hospitals were impacted and are being extorted by an individual using the name "Andrew" who has published clearnet pages and is demanding millions in cryptocurrency, while Oracle has provided limited, non-public notifications and guidance to customers.