Short answer
A Texas attorney general listing published on October 2, 2026 shows the 2025 breach of Oracle Health's legacy Cerner servers affected nearly 20 million people, far above earlier counts. Oracle says the data sat on an old server not yet moved to its cloud, and it has not publicly given a total.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Oracle Health (Cerner) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by authorities |
| Sector | Healthcare technology |
| Country | United States |
| Detected | 2025-02-20 |
| Disclosed | 2026-10-02 |
| People or records affected | Nearly 20 million people, per a Texas attorney general report cited by Bloomberg and SecurityWeek. Oracle has not publicly stated a total. |
What data was exposed
- Names
- Social Security numbers
- Addresses
- Medical record information, which may include medical record numbers, doctors, diagnoses, medicines, test results, images and care details
What happened
Cerner, the electronic health record vendor that Oracle bought in 2022, now runs as Oracle Health. In March 2025 Oracle began warning healthcare customers that patient data had been stolen from older Cerner servers. For more than a year there was no overall count. That changed in October 2026, when Cerner’s entry on the Texas attorney general’s breach portal, published October 2, listed 2,992,244 Texans, and SecurityWeek reported on October 8, citing Bloomberg and a Texas attorney general report, that the total had reached nearly 20 million people.
Techzine says the Texas report states that Oracle itself supplied the figure. Oracle has not published a total of its own.
How the intrusion worked
According to SecurityWeek, Oracle’s evidence suggests an attacker used stolen customer credentials to reach a legacy server after January 22, 2025 and copied data to a remote server. Oracle says it learned of the event on or around February 20, 2025, and that the data was on a server not yet moved to Oracle Cloud. Techzine reports Oracle denied any compromise of Oracle Cloud Infrastructure.
Counts differ by state
The state filings do not match, because each covers only that state’s residents. SecurityWeek lists about 283,000 in South Carolina and about 69,000 in Washington, alongside the Texas number. Do not add them up and compare against the 20 million figure, which comes from a separate Texas report.
What is still unknown
Oracle has not explained how the total rose so far above earlier counts, and it has not said how many people have received letters. Healthcare customers handled most notifications, so many patients may know the provider but not Oracle. If you receive a notice, the data involved can include diagnoses and medicines, which makes targeted calls more convincing. Our guide to what to do after a data breach covers freezes and monitoring, and phishing messages and urgent-payment scams show the usual follow-on lures. See our editorial policy for how we label figures.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Calls or texts from someone who knows your doctor, diagnosis or medicine and claims to be a hospital, insurer or Oracle
- Identity theft and new-account fraud using a stolen Social Security number
- Medical billing scams demanding payment for care you did not receive
- Fake breach-notice emails offering credit monitoring that ask you to log in or pay
What to do if you are affected
- 01Look for a notice letter from your hospital or provider, since Oracle's customers, not Oracle, notified patients. Use only the contact details printed in a letter you received.
- 02Consider a free credit freeze with Equifax, Experian and TransUnion, which blocks new accounts opened with your Social Security number.
- 03Read every explanation of benefits from your insurer and report services you did not receive.
- 04Check your state attorney general's breach page, since filings in Texas, Oregon, South Carolina and Washington list different counts.
- 05Do not click links in unexpected messages about this breach. Look up the provider's number yourself.
Frequently asked questions
How many people were affected by the Oracle Health breach?
Nearly 20 million, according to a Texas attorney general report cited by Bloomberg and SecurityWeek. Oracle has not publicly stated how many people were affected and declined to comment to Bloomberg.
What information was taken?
A sample notice filed with California regulators lists names, Social Security numbers and medical record information such as diagnoses, medicines and test results, according to SecurityWeek.
When did the breach happen?
Filings give a window of January 22 to April 1, 2025, and a discovery date of February 20, 2025, per SecurityWeek's reading of the Oregon filing. Oracle began notifying healthcare customers in March 2025.
Was Oracle Cloud hacked?
Oracle says the breach involved an old Cerner server that had not yet been moved to Oracle Cloud, and it denied that its cloud infrastructure was compromised, according to Techzine.
Did the attackers demand money?
SecurityWeek reports that sources told BleepingComputer a lone actor called Andrew tried to extort affected hospitals and demanded millions of dollars in cryptocurrency.
Sources
- Oracle Health Data Breach Tally Climbs to Nearly 20 Million, SecurityWeek, 2026-10-08
- Oracle medical data breach affected nearly 20 million people, Techzine, 2026-10-06
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.