Cybersecurity Incident at OSF HealthCare Exposes Patient Data via Former Vendor Cerner OSF HealthCare disclosed a cybersecurity incident involving its former electronic health record (EHR) vendor, Cerner, which may have exposed sensitive patient information. The breach, detected in September, stemmed from unauthorized access to legacy Cerner systems as early as January 2024. While OSF confirmed the incident did not affect its own systems or hospital operations, it impacted multiple healthcare facilities, though only patients of OSF Saint Clare Medical Center in Princeton were formally notified. Cerner, which no longer provides services to OSF, identified the breach and launched an investigation, securing the compromised systems and engaging external cybersecurity experts. Law enforcement requested a delay in notifying affected parties to avoid interfering with the probe. OSF began notifying patients in November after Cerner completed a data review, providing a list of individuals whose information may have been accessed. Exposed data includes patient names, Social Security numbers, medical record details (such as diagnoses, medications, test results, and treatment information), and physician names. As a precaution, OSF and Cerner are offering two years of complimentary credit monitoring and identity restoration services to affected patients. The incident highlights broader vulnerabilities in third-party healthcare IT systems, with Cerner confirming the breach extended beyond OSF facilities.

Cyberattack on OSF Healthcare Exposes Patient Data Across Northern Illinois In late December 2025, OSF Saint Clare Medical Center in Princeton disclosed a data breach affecting its medical records system provider, Cerner. The incident, first detected in January 2025, involved unauthorized access to sensitive patient information, including names, Social Security numbers, medical records, diagnoses, medications, and test results. Law enforcement requested a delay in notifying patients until September to avoid interfering with the investigation. OSF later confirmed that multiple facilities were impacted, though further details remain undisclosed. The breach highlights a growing trend of cyberattacks targeting healthcare systems, driven by their complex IT infrastructure, 24/7 operational demands, and the high stakes of downtime where even an hour offline can disrupt surgeries, patient portals, and critical test results. Cybersecurity experts, including Jon Pisani of PSM Partners, note that hospitals’ interconnected systems and urgency to restore services make them prime targets for ransomware and data theft. The rise of AI has further lowered the barrier for attackers, enabling faster data parsing and more efficient exploitation of vulnerabilities. However, AI tools used by employees can also introduce risks if sensitive information is inadvertently exposed on public platforms. Human error remains a key entry point for cybercriminals, with phishing emails often serving as the initial attack vector. Once inside, hackers may monitor communications, alter emails, or exfiltrate data before demanding ransom. Unlike ransomware, which can be mitigated with backups, data leaks pose long-term risks, as stolen information may be publicly disseminated even after systems are restored. In response, hospitals are adopting layered security measures, such as zero-trust models, restricted access, and continuous monitoring. Morris Hospital, which experienced a similar breach in 2023, implemented additional safeguards and offered free identity monitoring to affected individuals. Both OSF and Morris provided credit monitoring services and advised patients to monitor financial and medical records for suspicious activity. While healthcare systems continue to bolster defenses, experts caution that cybersecurity is an evolving challenge. As Pisani noted, new threats emerge as old vulnerabilities are addressed, ensuring that hospitals with their vast stores of valuable data will remain persistent targets.

OSF Healthcare in Illinois was attacked and data was exfiltrated from their systems by threat actor Xing Team. Xing Team started dumping patients data which apparently belonged to 53,907 OSF patients. The dumped data included patient names and contact information; dates of birth; Social Security numbers; driver’s license numbers; state or government identification numbers; treatment and diagnosis information and codes; physician names, dates of service, hospital units, prescription information and medical record numbers; and Medicare, Medicaid or other health insurance information. OSF Healthcare offered complimentary credit monitoring and identity protection services through Experian.

OSF HealthCare is committed to protecting the security and privacy of patient information suffered from a data breach incident after an unauthorized party gained access to their systems. The compromised information includes Dates of birth, Social Security numbers, driver's license numbers, state or government identification numbers, codes for diagnoses and treatments, names of the treating physicians, dates of their services, hospital units, prescription information, and medical records numbers, as well as Medicare, Medicaid, or other insurance information, are all examples of patient data. Financial account information, credit or debit card information, or login credentials for an online financial account were also present in the files involved in the incident for a smaller group of patients. They took this incident seriously and took preventive steps.