Union Health System reports data breach affecting 263K patients following Oracle Health/Cerner hack

Union Health System, a healthcare provider based in Terre Haute, Indiana, is reporting a breach affecting nearly 263,000 patients. The incident stems from a cybersecurity event involving unauthorized access to legacy patient data hosted on Oracle Health/Cerner servers that were in the process of migrating to Oracle's cloud environment. 

An unknown party initially contacted the healthcare provider claiming to possess information belonging to the organization. On February 24, Union Health verified these claims and identified the information as likely relating to data migration services performed by Oracle Health/Cerner.

Oracle Health/Cerner subsequently confirmed to Union Health on March 15 that it had experienced a cybersecurity incident involving unauthorized access to data in its migration environment. The compromised patient information includes:

• Names
• Social Security numbers
• Driver's license numbers
• Dates of birth
• Treating physicians
• Dates of service
• Medications
• Insurance information
• Treatment and diagnosis information

Union Health emphasized that the breach did not involve their own network, "live" electronic health records, or any other IT systems owned, operated, or administered by the healthcare provider.

Union Health is offering affected individuals complimentary identity and credit monitoring services.