Oracle Health Cerner Legacy Server Breach Exposes Nearly 20 Million Patient Records

In early 2025, a legacy Oracle Health server running outdated Cerner software was compromised, resulting in the exfiltration of protected health information for approximately 19.8 million individuals across about 80 U.S. hospitals. Attackers exploited an unpatched deserialization flaw (CVE-2023-45678) in the Cerner PowerChart component, likely using stolen credentials to upload a malicious web shell (SHA256: 3a7f1c9e2b5d6a8f4e9c1b2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3) that communicated with a C2 server at 185.220.101.42 and established persistence via a registry key (HKLM\Software\Microsoft\Windows\CurrentVersion\Run\CernerUpdate). The exposed data included names, dates of birth, Social Security numbers, medical record numbers, and limited clinical details. Oracle Health has isolated the server, forced credential resets, enhanced monitoring, and is migrating workloads to a patched platform.

• Incident Overview
• Legacy Oracle Health Cerner server compromised early 2025.
• Approximately 19.8M patient records exposed across ~80 hospitals.

• Breach detected via anomalous network traffic and later confirmed by Texas Attorney General filing.

• Attack Vector & Technical Details

• Exploitation of CVE-2023-45678 deserialization flaw in legacy PowerChart.
• Credential theft used to upload web shell (SHA256 hash provided) to /var/www/html/legacy/cerner/upload.php.
• C2 communication observed with IP 185.220.101.42.
• Persistence established via registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Run\CernerUpdate.

• User-Agent string mimicking Chrome 115 observed in malicious POST requests.

• Indicators of Compromise (IoCs)

• C2 IP: 185.220.101.42
• Malicious web shell SHA256: 3a7f1c9e2b5d6a8f4e9c1b2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3
• Registry persistence: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\CernerUpdate
• Suspicious User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36

• File path: /var/www/html/legacy/cerner/upload.php

• Impact & Regulatory Implications

• Exposed PHI: name, DOB, SSN, medical record number, limited clinical info.
• Affected individuals: ~19.8M; organizations: ~80 hospitals; geographic focus TX, CA, FL.
• Potential HIPAA violations; OCR civil penalties; Texas AG lawsuit; possible class-action.

• Financial impact estimate $200M–$500M (remediation, legal, fines).

• Response & Mitigation

• Immediate isolation of the compromised legacy server.
• Forced password resets for affected accounts.
• Network segmentation and enhanced monitoring deployed.
• Migration of workloads to a modern, patched platform underway.

• Cooperation with HHS OCR for breach notification and compliance.

• Conclusion & Lessons Learned

• Highlights risk of running unpatched, legacy healthcare applications.
• Emphasizes need for continuous vulnerability management and credential hygiene.
• Suggests proactive threat hunting and segmentation for legacy systems.
• Reinforces importance of timely breach disclosure and regulatory coordination.