Hackers have gained access to Oracle’s computer systems. They stole patient data to extort money from several American healthcare providers, as evident from a message that the company sent to its customers. The FBI has launched an investigation.
At the beginning of this month, Oracle informed healthcare customers that hackers had gained access to company servers on a date after January 22. Patient data was also copied to an external location, as evident from a report viewed by Bloomberg. Oracle sells patient file software to hospitals, groups of general practitioners, and other medical companies.
Stolen data
The FBI is currently investigating the breach and the attackers’ attempts to extort money from medical companies. It is still unclear how many patient records were stolen and how many healthcare providers have been targeted for extortion.
Oracle notified customers that the hackers used stolen customer data to access the systems. Available evidence suggests that the attacker gained illegal access to the environment by using stolen customer data,” the company stated in the notification. Oracle was informed of the breach around February 20.
According to Oracle information to customers, the hackers gained access to older Cerner servers and data that had not yet been migrated to Oracle’s cloud service. The stolen information could contain patient data from electronic medical records.
Connection with previous hacks
The news about this hack comes shortly after that of another Oracle data breach. It is now known that the data in the hands of an attacker named ‘rose87168’ is authentic. This attacker claims to have used an old RCE (Remote Code Execution) vulnerability.
Oracle initially denied a data breach of 6 million records, but research by CloudSEK showed that the domain login.us2.oraclecloud.com had indeed been compromised. It is not known whether this earlier attack is related to the now reported theft of patient data.
Cerner acquisition
In 2022, Oracle acquired the electronic patient record company Cerner Corporation for 28 billion dollars and promised to modernize the outdated software company, including moving customers to the cloud. The customer base includes large hospital chains, small clinics and government-run facilities.
The acquisition was accompanied by a 16 billion dollar flagship contract with the American Department of Veterans Affairs, which has been the subject of much publicity surrounding disruptions and parliamentary oversight. A spokesperson for the ministry reported that it has not been affected by the incident. Oracle has promised to offer its clients assistance in “assessing information to identify affected patients”.