State breach filings indicate that a cyberattack involving older Cerner systems compromised information belonging to approximately 19.9 million people, a figure substantially larger than some earlier patient notices suggested. The Texas Attorney General’s breach portal lists 2,992,244 affected Texas residents. The nationwide figure associated with that filing is 19,929,149.
Oracle has not independently confirmed the national total in a public statement, according to the supplied reporting. The Texas entry was published October 2, 2026. Reports from other states also describe affected residents: Oregon listed 1,978,661, South Carolina 283,903 and Washington 69,238. Those state figures are portions of the overall incident and should not be added to the national estimate.
The incident dates to early 2025. Oracle began notifying healthcare customers in March of that year after detecting unauthorized access involving legacy Cerner systems. Customer communications cited in the reporting said the company learned of the incident around February 20, 2025. Investigators found indications that an attacker used stolen customer credentials to access a legacy server sometime after January 22 and copied information to a remote server.
The server had not been migrated to Oracle Cloud. However, investigators have not publicly established that the server’s age caused the intrusion, and the method by which the credentials were obtained remains unclear. Oregon filings identify January 22 through April 1, 2025, as the reported breach period and February 20 as the discovery date.
Cerner, an electronic health-records company acquired by Oracle in June 2022 for about $28.3 billion, now operates as Oracle Health. Its technology is used by hospitals and other healthcare providers to manage patient information. The reported access therefore involved systems connected to multiple healthcare organizations, though the affected information and notification timing may differ among patients and states.
A sample notice filed with California regulators gives an indication of the data categories potentially involved. Depending on the individual, records may have included personal identifiers and medical information. The source reports that potentially exposed material could include Social Security numbers, diagnoses and medical images. It does not establish that every affected person had all of those details exposed.
Earlier reporting by BleepingComputer, as described in the source, said a person using the name “Andrew” contacted affected hospitals seeking cryptocurrency payments and threatened to release or sell patient data if they did not pay. The individual was also reported to have created public websites about the breach. Researchers had not established a link between that person and a known ransomware or extortion group. The supplied material does not report whether any organization paid.
The incident’s full scope has taken time to emerge through state disclosures, which can be issued at different times. The source compares the reported Oracle Health scale with the 2024 Change Healthcare breach, which it says ultimately affected approximately 192.7 million people. The Oracle-related figure is smaller, but still represents a large number of patients and sensitive records.
Oracle Health did not provide a response before the source’s deadline, according to the reporting. The available material does not establish that the attack resulted from a confirmed software vulnerability or prove that legacy infrastructure itself caused the breach. The reported investigative findings instead identify stolen credentials as the means of access, while leaving unanswered how those credentials were compromised.
