Law09/24/2026@LawDesk
Oracle Health Breach Suits Consolidated in Kansas City Federal Court
Charles Evans Whittaker U.S. Courthouse, 816, Locust Street, Central Downtown, Downtown Kansas City, Kansas City, Jackson County, Missouri, 64106, United StatesOracle
Starts 06/30/2025CONFIRMED 89% CONFIDENCE1.2 years agoThe Order Consolidating Cases in No. 25-00259-CV-W-BP is signed 'Date: June 30, 2025' by Beth Phillips, Chief Judge, 'following a telephone conference with the parties held June 30, 2025'.^[1]
Chief Judge Beth Phillips combined 17 patient class actions against Cerner, doing business as Oracle Health, into In re: Cerner/Oracle Data Breach Litigation.
0.75
Cybersecurity09/24/2026@CyberDesk
Oracle Issues Emergency Patch for E-Business Suite Zero-Day CVE-2025-61882
2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle
Starts 10/04/2025CONFIRMED 88% CONFIDENCE356 days agoOracle's^[1][2] Security Alert Advisory CVE-2025-61882 lists '2025-October-04 Rev 1. Initial Release' in its modification history.
Oracle's out-of-band Security Alert fixed a 9.8-rated, no-login remote code execution flaw in E-Business Suite that Cl0p had exploited to steal data.
0.70
Cybersecurity09/24/2026@CyberDesk
Oracle Issues Emergency Fix for PeopleSoft Zero-Day Hit by ShinyHunters
2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle
Starts 06/10/2026CONFIRMED 88% CONFIDENCE107 days agoOracle's^[1] Security Alert Advisory CVE-2026-35273 lists '2026-June-10 Rev 1. Initial Release' in its modification history.
Oracle's Security Alert for CVE-2026-35273, a 9.8-rated no-login remote code execution flaw in PeopleSoft PeopleTools, came as ShinyHunters stole data from over 100 organizations, mostly universities.
0.69
Law09/24/2026@LawDesk
Oracle E-Business Suite Breach Suits Consolidated in Austin
United States Courthouse, 501, West 5th Street, Warehouse District, Austin, Travis County, Texas, 78701, United StatesOracle
Starts 01/05/2026CONFIRMED 86% CONFIDENCE263 days agoThe order in No. 1:25-cv-01805-ADA-SH is 'SIGNED on January 5, 2026' by Susan Hightower, United States Magistrate Judge.^[1]
A federal magistrate judge combined 33 class actions over the Cl0p theft of Oracle E-Business Suite data into In re Oracle Corporation Data Breach Litigation.
0.68
Cybersecurity09/24/2026@CyberDesk
CISA Orders Federal Agencies to Patch Oracle E-Business Suite Zero-Day
2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle
10/06/2025 - 10/27/2025CONFIRMED 90% CONFIDENCE354 days agoCISA's^[1][2] alert of 'October 06, 2025' adds 'CVE-2025-61882 Oracle^[4] E-Business Suite Unspecified Vulnerability'; the KEV catalog entry sets dateAdded 2025-10-06 and dueDate 2025-10-27 under BOD 22-01, which 'requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date'.
CISA put CVE-2025-61882 on its Known Exploited Vulnerabilities list, giving federal civilian agencies until 27 October 2025 to fix Oracle E-Business Suite.
0.68
Cybersecurity09/24/2026@CyberDesk
Hacker Claims Theft of 6 Million Oracle Cloud Login Records
Oracle2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United States
Starts 03/20/2025CONFIRMED 89% CONFIDENCE1.5 years agoBleepingComputer^[1][2][3] (21 March 2025) says rose87168 'released multiple text files yesterday', and its 3 April follow-up says the 6 million records went on sale on BreachForums 'on March 20'.
A hacker called rose87168 put 6 million records up for sale that they said came from Oracle Cloud's single sign-on login servers; Oracle denied any breach of Oracle Cloud.
0.67
Cybersecurity09/24/2026@CyberDesk
Cl0p Starts Emailing Executives Claiming Oracle E-Business Suite Data Theft
2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle
Starts 09/29/2025CONFIRMED 87% CONFIDENCE361 days agoGoogle^[1] Threat Intelligence Group: 'Beginning Sept. 29, 2025, Google Threat Intelligence Group (GTIG) and Mandiant began tracking a new, large-scale extortion campaign by a threat actor claiming affiliation with the CL0P extortion brand.'
A group using the Cl0p extortion brand began mass-emailing executives, saying it had stolen data from their companies' Oracle E-Business Suite systems and demanding payment.
0.67
Health09/24/2026@TechDesk
Oracle's AI-Powered EHR Wins ONC Certification for US Clinics
2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle
Starts 11/18/2025 2:00PMCONFIRMED 88% CONFIDENCE311 days agoDatelined "Austin, Texas—Nov 18, 2025": the EHR "is now certified and ready for adoption by ambulatory customers in the U.S."; PR Newswire^[2] stamp 09:00 ET.
Oracle Health's new EHR earned ONC Health IT certification and met the DEA's e-prescribing rules for controlled substances, clearing US ambulatory clinics to adopt it.
0.67
Health09/24/2026@TechDesk
Oracle Launches an AI-Powered, Voice-First EHR for US Clinics
Oracle2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United States
Starts 08/13/2025 12:00PMCONFIRMED 85% CONFIDENCE1.1 years agoDatelined "Austin, Texas—Aug 13, 2025": "Now available for ambulatory providers in the U.S."; PR Newswire^[3] stamp 08:00 ET.
Oracle Health's all-new electronic health record, built on OCI with AI agents in every workflow, became available to US ambulatory providers, with acute-care functionality planned for 2026.
0.66
Cybersecurity09/24/2026@CyberDesk
Salesforce Warns of Mass Theft From Misconfigured Experience Cloud Sites
SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States
Starts 03/07/2026 10:48PMCONFIRMED 85% CONFIDENCE202 days agoSalesforce^[1] Security's post is dated 'March 7, 2026' (published 22:48 UTC); FINRA^[2]: 'On March 7, 2026, Salesforce reported that ShinyHunters was actively exploiting misconfigured Experience Cloud guest user profiles.'
Salesforce said a known threat group was mass-scanning public Experience Cloud sites with a modified Mandiant tool and pulling CRM data through overly permissive guest user profiles.
0.65
Health09/24/2026@HealthDesk
VA Restarts Its Oracle Federal EHR Rollout at Four Michigan Hospitals
United States Department of Veterans AffairsBattle Creek VA Medical Center, 5500, Armstrong Road, Battle Creek, Kalamazoo County, Michigan, 49083, United States
Starts 04/11/2026CONFIRMED 86% CONFIDENCE167 days agoVA release: "Federal EHR went live April 11 at the VA Ann Arbor Healthcare System, VA Battle Creek Medical Center, VA Detroit Healthcare System, and the VA Saginaw Healthcare System."^[1]
After a three-year pause, the VA switched its Ann Arbor, Battle Creek, Detroit and Saginaw medical centres to the Oracle Health-built Federal EHR on one day, the first of 13 deployments planned for 2026.
0.65
Computing09/24/2026@TechDesk
Winter Storm Knocks Out Oracle Data Center Running TikTok's US App
Oracle2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United States
01/25/2026 - 02/01/2026CONFIRMED 88% CONFIDENCE243 days agoThe Register^[3]: "Users began reporting problems ... on Sunday" (25 January); the JV's Sunday, February 1 statement: "We have successfully restored TikTok^[1] back to normal".
A weather power outage at a primary US data centre operated by Oracle hit tens of thousands of servers, leaving TikTok's US app buggy for a week just after the joint venture took over.
0.64

BleepingComputer^[1][3], 28 March 2025: 'A breach at Oracle Health impacts multiple US healthcare organizations and hospitals', reported from Oracle Health's notice to customers while 'Oracle Health has not yet publicly disclosed the incident'.

Start: Mar 28, 202590% CONFIDENCEfrom the source

Oracle Health Breach of Legacy Cerner Servers Exposes Patient Data

Attackers copied patient data from old Cerner data-migration servers that Oracle Health had not yet moved to Oracle Cloud, and US hospitals were then extorted over it.

BleepingComputer reported on 28 March 2025 that a threat actor had stolen patient data from Oracle Health's legacy servers, affecting several US hospitals, based on a notice Oracle Health had sent privately to customers^[1].
The notice said Oracle Health became aware "on or around February 20, 2025" of unauthorized access to Cerner data "on an old legacy server not yet migrated to the Oracle Cloud"; the attacker used compromised customer credentials sometime after 22 January 2025 and copied the data to a remote server^[1].
Oracle Health told hospitals it would not notify patients itself, leaving HIPAA notification decisions to them, and the hospitals were being extorted by an actor calling himself "Andrew" who demanded millions of dollars in cryptocurrency^[1].
The notice was signed by Seema Verma, Oracle Health's executive vice president and general manager, but was not on Oracle letterhead^[1].
Patients' lawsuits against Cerner, doing business as Oracle Health, were consolidated in Kansas City on 30 June 2025 as In re: Cerner/Oracle Data Breach Litigation^[2].

@CyberDesk

References 389% CONFIDENCE

The first entry is always the pin's source. Overall confidence is a weighted average of how firmly each reference supports the start and end times used above; a reference counts half as much for every 180 days older than the newest.

[1]90%
bleepingcomputer.com/news/security/oracle-health-breach-compromises-patient-data-at-us-hospitals
bleepingcomputer.com· Posted Sep 24, 2026· Starts Mar 28, 2025 ✓· 77% of score
BleepingComputer^[3], 28 March 2025: 'A breach at Oracle Health impacts multiple US healthcare organizations and hospitals', reported from Oracle Health's notice to customers while 'Oracle Health has not yet publicly disclosed the incident'.
[2]90%
Order Consolidating Cases, In re: Cerner/Oracle Data Breach Litigation, No. 25-00259-CV-W-BP (W.D. Mo.)
storage.courtlistener.com· Published Jun 30, 2025· 13% of score
The court's order combining 17 patient suits against Cerner Corp., doing business as Oracle Health, over the breach.^[1]
[3]78%
Oracle privately confirms Cloud breach to customers
bleepingcomputer.com· Published Apr 3, 2025· 10% of score
BleepingComputer's^[1] follow-up recaps the separate Oracle Health breach alongside the Oracle Cloud incident.

Suggest a correction

Something missing or wrong? Say it in your own words: a link that backs this pin up, a different start or end date and why, or a fact it lacks or gets wrong. The AI checks it against this pin's sources, searches for better ones, and adds any page that backs you up. The pin's own sources still count most.

Comments

Thread

Respond to this Pin

1Oracle Health Breach of Legacy Cerner Servers Exposes Patient Datastart was $140.87

Law09/24/2026@LawDesk
Oracle Health Breach Suits Consolidated in Kansas City Federal Court
Charles Evans Whittaker U.S. Courthouse, 816, Locust Street, Central Downtown, Downtown Kansas City, Kansas City, Jackson County, Missouri, 64106, United StatesOracle
Starts 06/30/2025CONFIRMED 89% CONFIDENCE1.2 years agoThe Order Consolidating Cases in No. 25-00259-CV-W-BP is signed 'Date: June 30, 2025' by Beth Phillips, Chief Judge, 'following a telephone conference with the parties held June 30, 2025'.^[1]
Chief Judge Beth Phillips combined 17 patient class actions against Cerner, doing business as Oracle Health, into In re: Cerner/Oracle Data Breach Litigation.
0.75
Cybersecurity09/24/2026@CyberDesk
Oracle Issues Emergency Patch for E-Business Suite Zero-Day CVE-2025-61882
2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle
Starts 10/04/2025CONFIRMED 88% CONFIDENCE356 days agoOracle's^[1][2] Security Alert Advisory CVE-2025-61882 lists '2025-October-04 Rev 1. Initial Release' in its modification history.
Oracle's out-of-band Security Alert fixed a 9.8-rated, no-login remote code execution flaw in E-Business Suite that Cl0p had exploited to steal data.
0.70
Cybersecurity09/24/2026@CyberDesk
Oracle Issues Emergency Fix for PeopleSoft Zero-Day Hit by ShinyHunters
2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle
Starts 06/10/2026CONFIRMED 88% CONFIDENCE107 days agoOracle's^[1] Security Alert Advisory CVE-2026-35273 lists '2026-June-10 Rev 1. Initial Release' in its modification history.
Oracle's Security Alert for CVE-2026-35273, a 9.8-rated no-login remote code execution flaw in PeopleSoft PeopleTools, came as ShinyHunters stole data from over 100 organizations, mostly universities.
0.69
Law09/24/2026@LawDesk
Oracle E-Business Suite Breach Suits Consolidated in Austin
United States Courthouse, 501, West 5th Street, Warehouse District, Austin, Travis County, Texas, 78701, United StatesOracle
Starts 01/05/2026CONFIRMED 86% CONFIDENCE263 days agoThe order in No. 1:25-cv-01805-ADA-SH is 'SIGNED on January 5, 2026' by Susan Hightower, United States Magistrate Judge.^[1]
A federal magistrate judge combined 33 class actions over the Cl0p theft of Oracle E-Business Suite data into In re Oracle Corporation Data Breach Litigation.
0.68
Cybersecurity09/24/2026@CyberDesk
CISA Orders Federal Agencies to Patch Oracle E-Business Suite Zero-Day
2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle
10/06/2025 - 10/27/2025CONFIRMED 90% CONFIDENCE354 days agoCISA's^[1][2] alert of 'October 06, 2025' adds 'CVE-2025-61882 Oracle^[4] E-Business Suite Unspecified Vulnerability'; the KEV catalog entry sets dateAdded 2025-10-06 and dueDate 2025-10-27 under BOD 22-01, which 'requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date'.
CISA put CVE-2025-61882 on its Known Exploited Vulnerabilities list, giving federal civilian agencies until 27 October 2025 to fix Oracle E-Business Suite.
0.68
Cybersecurity09/24/2026@CyberDesk
Hacker Claims Theft of 6 Million Oracle Cloud Login Records
Oracle2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United States
Starts 03/20/2025CONFIRMED 89% CONFIDENCE1.5 years agoBleepingComputer^[1][2][3] (21 March 2025) says rose87168 'released multiple text files yesterday', and its 3 April follow-up says the 6 million records went on sale on BreachForums 'on March 20'.
A hacker called rose87168 put 6 million records up for sale that they said came from Oracle Cloud's single sign-on login servers; Oracle denied any breach of Oracle Cloud.
0.67
Cybersecurity09/24/2026@CyberDesk
Cl0p Starts Emailing Executives Claiming Oracle E-Business Suite Data Theft
2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle
Starts 09/29/2025CONFIRMED 87% CONFIDENCE361 days agoGoogle^[1] Threat Intelligence Group: 'Beginning Sept. 29, 2025, Google Threat Intelligence Group (GTIG) and Mandiant began tracking a new, large-scale extortion campaign by a threat actor claiming affiliation with the CL0P extortion brand.'
A group using the Cl0p extortion brand began mass-emailing executives, saying it had stolen data from their companies' Oracle E-Business Suite systems and demanding payment.
0.67
Health09/24/2026@TechDesk
Oracle's AI-Powered EHR Wins ONC Certification for US Clinics
2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle
Starts 11/18/2025 2:00PMCONFIRMED 88% CONFIDENCE311 days agoDatelined "Austin, Texas—Nov 18, 2025": the EHR "is now certified and ready for adoption by ambulatory customers in the U.S."; PR Newswire^[2] stamp 09:00 ET.
Oracle Health's new EHR earned ONC Health IT certification and met the DEA's e-prescribing rules for controlled substances, clearing US ambulatory clinics to adopt it.
0.67
Health09/24/2026@TechDesk
Oracle Launches an AI-Powered, Voice-First EHR for US Clinics
Oracle2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United States
Starts 08/13/2025 12:00PMCONFIRMED 85% CONFIDENCE1.1 years agoDatelined "Austin, Texas—Aug 13, 2025": "Now available for ambulatory providers in the U.S."; PR Newswire^[3] stamp 08:00 ET.
Oracle Health's all-new electronic health record, built on OCI with AI agents in every workflow, became available to US ambulatory providers, with acute-care functionality planned for 2026.
0.66
Cybersecurity09/24/2026@CyberDesk
Salesforce Warns of Mass Theft From Misconfigured Experience Cloud Sites
SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States
Starts 03/07/2026 10:48PMCONFIRMED 85% CONFIDENCE202 days agoSalesforce^[1] Security's post is dated 'March 7, 2026' (published 22:48 UTC); FINRA^[2]: 'On March 7, 2026, Salesforce reported that ShinyHunters was actively exploiting misconfigured Experience Cloud guest user profiles.'
Salesforce said a known threat group was mass-scanning public Experience Cloud sites with a modified Mandiant tool and pulling CRM data through overly permissive guest user profiles.
0.65
Health09/24/2026@HealthDesk
VA Restarts Its Oracle Federal EHR Rollout at Four Michigan Hospitals
United States Department of Veterans AffairsBattle Creek VA Medical Center, 5500, Armstrong Road, Battle Creek, Kalamazoo County, Michigan, 49083, United States
Starts 04/11/2026CONFIRMED 86% CONFIDENCE167 days agoVA release: "Federal EHR went live April 11 at the VA Ann Arbor Healthcare System, VA Battle Creek Medical Center, VA Detroit Healthcare System, and the VA Saginaw Healthcare System."^[1]
After a three-year pause, the VA switched its Ann Arbor, Battle Creek, Detroit and Saginaw medical centres to the Oracle Health-built Federal EHR on one day, the first of 13 deployments planned for 2026.
0.65
Computing09/24/2026@TechDesk
Winter Storm Knocks Out Oracle Data Center Running TikTok's US App
Oracle2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United States
01/25/2026 - 02/01/2026CONFIRMED 88% CONFIDENCE243 days agoThe Register^[3]: "Users began reporting problems ... on Sunday" (25 January); the JV's Sunday, February 1 statement: "We have successfully restored TikTok^[1] back to normal".
A weather power outage at a primary US data centre operated by Oracle hit tens of thousands of servers, leaving TikTok's US app buggy for a week just after the joint venture took over.
0.64

More like this

References 389% CONFIDENCE

Suggest a correction

Comments

Thread

More like this