On June 27, 2025, Mosaic Life Care (“Mosaic”) mailed notification letters to certain Mosaic patients whose personal information was involved in the Oracle Health/Cerner incident.

An unknown party contacted Mosaic claiming they had some patient information in their possession, which we verified on April 29, 2025. Mosaic then identified the information as likely obtained from Oracle Health/Cerner systems related to data migration services it was performing, and reached out to Oracle Health/Cerner for confirmation. Mosaic also notified law enforcement.

On May 2, 2025, Oracle Health/Cerner confirmed that the files received from the unknown party came from Oracle Health/Cerner’s environment. Oracle Health/Cerner further informed Mosaic that, an unknown party accessed Oracle Health/Cerner’s migration environment at least as early as January 22, 2025 using compromised credentials. On June 6, 2025, Oracle Health/Cerner provided us with a list of Mosaic patients whose information was involved.

It is important to note that the incident involved Oracle Health/Cerner’s system, not Mosaic’s systems.  In other words, this incident did not involve access to, or a compromise of, any Mosaic owned, operated or administered systems, including  Mosaic’s live EHR. 

The files involved in the incident contained information that varied by patient but could have included patients’ names and one or more of the following: Social Security numbers, driver’s license numbers, dates of birth, treating physicians, dates of service, medication information, insurance information and treatment and/or diagnostic information.

While the incident did not impact Mosaic’s own network, we are notifying you of this incident and sharing the steps that we are taking in response. We remain committed to upholding high standards of custodianship of information held by our third-party vendors, including Oracle Health/Cerner.  Mosaic is offering complimentary identity monitoring services to patients. Additionally, it is always a good idea for patients to review statements they receive from their healthcare provider or health insurer. If they identify charges for services they did not receive, they should contact the healthcare provider or health insurer immediately.

We also established a dedicated, toll-free call center to help answer questions about the Oracle Health/Cerner incident. The call center can be reached at 1-855-361-0316, Monday through Friday, between 8 a.m. and 8 p.m. Central Time, excluding major U.S. holidays.