At ChristianaCare, we take patient privacy and the protection of patient data very seriously. ChristianaCare is one of a number of healthcare organizations nationwide whose data is involved in recent cybersecurity incident that occurred at Oracle Health (formerly Cerner Corporation). ChristianaCare’s IT systems were not impacted, and there was no disruption to ChristianaCare’s clinical operations.
Oracle Health, formerly Cerner Corporation, is a third-party electronic health records (EHR) vendor used by many healthcare providers, including ChristianaCare. In April, Oracle Health informed us that an unauthorized third party gained access to legacy Cerner systems as early as January 22, 2025, and obtained certain data.
Upon learning of the incident, Oracle Health began an investigation, engaged external cybersecurity specialists, and engaged with federal law enforcement, who requested the delay of patient notifications while they conducted their investigation.
On September 29, 2025, Oracle Health provided ChristianaCare with a list of ChristianaCare patients whose information may have been involved in the incident. The information varied by patient but may include names, Social Security numbers and information included within patient medical records, such as medical record numbers, doctors, diagnoses, medicines, test results, images, care and treatment.
Letters are being mailed to patients whose information was involved in this incident, including an offer of a complimentary two-year membership to credit monitoring and/or minor identity protection services.
Patients are encouraged to review statements they receive from their health care providers and health insurer and immediately report any inaccuracies to the provider or insurer. Individuals who have questions about this cybersecurity incident may contact 833-745-1528 toll free, Monday through Friday from 9am – 9pm Eastern Time (excluding major U.S. holidays) and provide engagement number B155349.
We regret any concern that Oracle Health’s incident may cause our patients, and we continue to review and assess the cybersecurity protections of our third-party vendors.
