Oracle Health breach affects 19.9 million patients

Filings with the Texas Attorney General indicate that a cyberattack involving legacy Cerner systems compromised the personal and medical information of approximately 19.9 million people. The incident, which investigators say began in early 2025, is among the largest healthcare data breaches in U.S. history, though Oracle has not separately confirmed the nationwide total in a public statement.

The attack targeted older systems belonging to Cerner, an electronic health records company that Oracle acquired in June 2022 for approximately $28.3 billion. The business now operates as Oracle Health. Because Cerner's technology manages patient information for numerous hospitals and providers, unauthorized access to these legacy systems exposed records across multiple healthcare organizations. Oracle began notifying affected customers in March after discovering the unauthorized access, with the company becoming aware of the incident around February 20, 2025.

Investigators found evidence suggesting an attacker used stolen customer credentials to access a legacy server sometime after January 22, 2025. The attacker then copied information to a remote server that had not yet been migrated to Oracle Cloud. While the server's age may have played a role, investigators have not publicly established a causal link between the system's age and the breach. Furthermore, the precise method by which the attacker obtained the stolen credentials remains unclear.

State filings provide a clearer view of the attack's geographic spread. The Texas Attorney General's portal, which published Cerner's entry on October 2, 2026, lists 2,992,244 affected Texas residents. Other state notifications show the incident's reach: Oregon reported 1,978,661 affected residents, South Carolina identified 283,903, and Washington reported 69,238. These figures represent portions of the overall incident and should not be added to the nationwide total. Filings with Oregon regulators identify January 22 through April 1, 2025, as the reported breach period.

BleepingComputer previously reported that a person identifying as "Andrew" reached out to impacted hospitals to request cryptocurrency payments. The individual allegedly warned that patient data would be released or sold if demands were not met and set up public websites to apply further pressure on medical facilities. Researchers had not linked this actor to any established ransomware or extortion group at that time.

A sample breach notification filed with California regulators details the types of information potentially exposed. Depending on the patient, compromised records may have included Social Security numbers, diagnoses, and medical images. Unlike a stolen credit card, medical history cannot be canceled or replaced. Criminals could potentially use this data to create convincing medical scams, impersonate patients, or commit identity theft by combining medical details with other stolen information.

The Oracle Health incident follows a similar breach at Change Healthcare, a subsidiary of UnitedHealth Group, which affected approximately 192.7 million people in 2024. While smaller by comparison, the reported 20 million affected individuals in this case still represents a massive exposure of sensitive data. The incident highlights the challenges of protecting records stored on older systems that remain essential to daily operations during technology upgrades.

Patients are advised to check mail for notices from Cerner, Oracle Health, or their healthcare providers to determine what information may have been exposed. Contacting a hospital's privacy office directly is another recommended step. To mitigate risks of identity theft and medical fraud, individuals can place free credit freezes through Equifax, Experian, and TransUnion. Reviewing health insurance explanation of benefits statements for unrecognized appointments or treatments is also critical for catching potential medical identity theft early.