Oracle under fire for its handling of separate security incidents

Summary

Tech giant Oracle is facing criticism for how it’s handling two seemingly separate data breaches. At least one of the incidents appears to still be unfolding, despite Oracle reportedly denying a breach at all. The other relates to a breach of patient data under the tech giant’s healthcare subsidiary, Oracle Health. Oracle did not respond to TechCrunch’s request for comment about the two incidents. Oracle Health breach affects patient data, per reports The breach disclosed most recently involves Oracle Health, which provides hospitals and other healthcare providers with technology to access health records online. Oracle Health is a unit that was combined with Cerner, an electronic health records company that Oracle acquired in 2022 for $28 billion. Bloomberg and Bleeping Computer reported last week that the breach affects patient data, although it’s unclear exactly what kinds of data were stolen, nor which organizations and companies that use Oracle Health are affected. Oracle notified some of its healthcare customers in March of a breach that happened sometime earlier this year, in which hackers accessed Oracle servers and stole patient data, according to the publications. Contact Us Do you have more information about these two Oracle breaches? From a non-work device and network, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email. You also can contact TechCrunch via SecureDrop. “We are writing to inform you that, on or around February 20, 2025, we became aware of a cybersecurity event involving unauthorized access to some amount of your Cerner data that was on an old legacy server not yet migrated to the Oracle Cloud,” read the notification sent to some Oracle Health customers, according to Bleeping Computer. Citing multiple sources, the news site reported that a hacker is trying to extort affected hospitals, reportedly demanding millions of dollars. An Oracle employee, who asked to r...