HackingHealthcareTechnologyHealthcareData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHealth (basic)HighActive

Cerner Corporation

bd_15fce9bcc4fb243c · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 20, 2025

Filed

Dec 19, 2025

To disclose

43 weeks

Affected

58,823state residents only

Confidence

65%

Full breach record for Cerner Corporation →4 incidents on file

Cerner Corporation notified the New Hampshire Attorney General of a security incident involving unauthorized access to PHI on legacy systems. The breach affected approximately 58,823 NH residents, exposing names, SSNs, and medical records. Access occurred as early as Jan 22, 2025; discovered Feb 20, 2025. Notifications began June 13, 2025. Law enforcement requested notification delays. Cerner engaged forensic specialists, reset credentials, and implemented network isolation. Affected individuals received credit monitoring and identity restoration services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 29 days

discovery → filing · 43 weeks / 302 days

Jan 22, 2025

Begins

Feb 20, 2025

Discovered

Dec 19, 2025

Filed

vs. sector median

+31 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed58,823 affectedView incident

Name: WilmerHale
norm: wilmerhale

Name: Cerner Corporation
norm: cerner
Domain: cerner.com
Industry: HealthcarellmTechnologyllm

Discovered: Feb 20, 2025
Breach occurred: Jan 22, 2025
Undetected for: 29 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 13, 2025
Affected individuals: 58,823state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: contacted law enforcementLaw enforcement investigators directed Cerner to delay notifying additional potentially impacted customers
Initial access: exploit_public_facing

During the incident: Began an investigation
Engaged external cybersecurity specialists
Contacted law enforcement
Rotating credentials
Implementing additional technical protections such as network isolation, host hardening, and built-in utility restrictions
Changes made: Rotating credentials
Implementing additional technical protections such as network isolation, host hardening, and built-in utility restrictions
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 43 weeks(302 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cerner-20251219.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 19, 2025
Raw hash: 76f5093007fbf9c1993f1b933fa3b143bc518eac093534ce62f75902a42e5b7d

Reporting entityWilmerHale

Victim entityCerner Corporation

Incidentdiscovered Feb 20, 2025

Stated responseBegan an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov