[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fl8VBJFRsoPpW29fuzgfSVDVZPtXxAi9cRv1u1GKLizw":3},{"article":4,"iocs":46,"watch_terms":50,"solutions":51,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"9f7d93ae-be29-4544-afbd-fa37cf1a2058","Oracle Health Data Breach Tally Climbs to Nearly 20 Million","oracle-health-data-breach-tally-climbs-to-nearly-20-million-336b1a","The figure is far higher than the counts that surfaced in earlier filings and patient notifications. The post Oracle Health Data Breach Tally Climbs to Nearly 20 Million appeared first on SecurityWeek.","A cyberattack on Oracle Health's legacy Cerner systems has compromised the personal and medical information of nearly 20 million people, a figure significantly higher than initially reported. The breach, which occurred early last year, involved unauthorized access to data on an old server using stolen customer credentials. The threat actor, identified as 'Andrew,' demanded millions in cryptocurrency to prevent data leaks.","Oracle Health data breach impacts nearly 20 million individuals.","https:\u002F\u002Fwww.securityweek.com\u002Foracle-health-data-breach-tally-climbs-to-nearly-20-million\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F03\u002Fhealthcare-medical.jpeg","2026-10-08T08:23:31+00:00","2026-10-08T10:00:22.918662+00:00",8,[17,20,23,25],{"name":18,"type":19},"Oracle","vendor",{"name":21,"type":22},"Cerner","product",{"name":24,"type":22},"Oracle Health",{"name":26,"type":27},"Andrew","threat_actor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":28,"icon":30,"name":31,"slug":32},null,"Breaches","breaches",[34,36,41],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":48,"value":26,"context":49},"malware","Threat actor demanding ransom in Oracle Health data breach",[18,21,24],{"controls":52,"vendors":140},[53,82,111],{"slug":54,"name":55,"problem":56,"products":57},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":83,"name":84,"problem":85,"products":86},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":112,"name":113,"problem":114,"products":115},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[141],{"slug":142,"name":18,"logo_path":143,"roles":144},"oracle","\u002Fvendor-logos\u002Foracle.png",[145],"affected",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":165},"oracle-healths-legacy-cerner-breach-exposes-20-million-records","Oracle Health's Legacy Cerner Breach Exposes 20 Million Records","The Oracle Health breach stemmed from unauthorized access to an unpatched, legacy Cerner server using stolen customer credentials — a combination of poor lifecycle management and weak access controls. Legacy systems that are no longer actively maintained represent a critical attack surface, especially when they still hold sensitive healthcare data. The fact that the breach went undetected long enough to affect nearly 20 million individuals highlights severe gaps in monitoring and incident response. Healthcare organizations must treat decommissioning or hardening of legacy systems as a patient safety and regulatory obligation, not merely an IT housekeeping task.",[151,152,153,154,155,156,157,158,159,160,161,162,163,164],"CIS Control 1 – Inventory and Control of Enterprise Assets","CIS Control 5 – Account Management","CIS Control 7 – Continuous Vulnerability Management","CIS Control 12 – Network Infrastructure Management","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 IA-5 – Authenticator Management","NIST SP 800-53 SI-2 – Flaw Remediation","NIST SP 800-53 SC-7 – Boundary Protection","HIPAA Security Rule – 45 CFR §164.312(a)(1) – Access Control","HIPAA Security Rule – 45 CFR §164.312(b) – Audit Controls","NIST CSF ID.AM-1 – Asset Inventory","NIST CSF PR.AC-4 – Access Permissions and Authorizations","GDPR Article 32 – Security of Processing","ITIL – Service Transition: Change and Release Management",{}]