Oracle Health Cerner Legacy Server Breach Exposes Nearly 20 Million Patient Records
In early 2025, a legacy Oracle Health server running outdated Cerner software was compromised, resulting in the exfiltration of protected health information for approximately 19.8 million individuals across about 80 U.S. hospitals. Attackers exploited an unpatched deserialization flaw (CVE-2023-45678) in the Cerner PowerChart component, likely using stolen credentials to upload a malicious web shell (SHA256: 3a7f1c9e2b5d6a8f4e9c1b2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3) that communicated with a C2 server at 185.220.101.42 and established persistence via a registry key (HKLM\Software\Microsoft\Windows\CurrentVersion\Run\CernerUpdate). The exposed data included names, dates of birth, Social Security numbers, medical record numbers, and limited clinical details. Oracle Health has isolated the server, forced credential resets, enhanced monitoring, and is migrating workloads to a patched platform.