HackingData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICHighActive
Cerner Corporation
bd_15fce9bcc4fb243c · schema v1 · pii pii-v1
Full breach record for Cerner Corporation →Cerner Corporation notified the New Hampshire Attorney General of a security incident involving unauthorized access to PHI on legacy systems. The breach affected approximately 58,823 NH residents, exposing names, SSNs, and medical records. Access occurred as early as Jan 22, 2025; discovered Feb 20, 2025. Notifications began June 13, 2025. Law enforcement requested notification delays. Cerner engaged forensic specialists, reset credentials, and implemented network isolation. Affected individuals received credit monitoring and identity restoration services.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed58,823 affectedView incident
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/cerner-20251219.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 19, 2025
- Raw hash
- 76f5093007fbf9c1993f1b933fa3b143bc518eac093534ce62f75902a42e5b7d
Reporting entity
- Name
- WILMER CUTLER PICKERING HALE AND DORR LLPnorm: wilmer cutler pickering hale and dorr
Victim entity
- Name
- Cerner Corporationnorm: cerner
- Domain
- cerner.com
Incident
- Discovered
- Feb 20, 2025
- Materiality determined
- —
- Notification sent
- Jun 13, 2025
- Affected individuals
- 58,823
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- contacted law enforcementLaw enforcement investigators directed Cerner to delay notifying additional potentially impacted customers
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 43 weeks(302 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.