The Oracle Health data breach compromised personal and medical information belonging to nearly 20 million people after attackers accessed legacy Cerner systems in early 2025, Bloomberg reported alongside records from the Texas attorney general. The figure is far higher than earlier filings and patient notifications, while Oracle has not publicly disclosed the total number of affected individuals and declined to comment to Bloomberg.
Key Points
- Nearly 20 million people may have been affected by the Oracle Health breach.
- Attackers used stolen customer credentials to access an old Cerner server and copy data.
- Exposed information included Social Security numbers and sensitive medical records.
- State filings have identified millions of affected residents, and the FBI is investigating.
How the breach unfolded
Cerner became part of Oracle in June 2022 through a deal valued at roughly $28.3 billion, and the business now operates as Oracle Health. Oracle began alerting healthcare customers in March 2025 about unauthorized access to Cerner data stored on a legacy server that had not yet been migrated to Oracle Cloud.
Oracle told customers that available evidence indicated the attacker used stolen customer credentials to access the server sometime after January 22, 2025, and copied data to a remote server. Oracle’s notice identified February 20, 2025, as the date the company became aware of the cybersecurity event.
Oracle described the event in its customer notice:
“We are writing to inform you that, on or around February 20, 2025, we became aware of a cybersecurity event involving unauthorized access to some amount of your Cerner data that was on an old legacy server not yet migrated to the Oracle Cloud.”
Oracle
BleepingComputer reported that extortion attempts against affected hospitals came from an individual threat actor known as Andrew. The actor had not claimed links to an established ransomware or extortion group, demanded millions of dollars in cryptocurrency, and created public websites about the breach to pressure victims.
- Jan. 22, 2025: The attacker appears to have gained access to an old Cerner server sometime after this date. Oracle said stolen customer credentials were used.
- Feb. 20, 2025: Oracle discovered the unauthorized access and said the attacker had copied data to another server.
- March 2025: Oracle began notifying affected healthcare customers about the breach. The FBI investigation was also reported publicly.
- 2025–2026: Healthcare organizations and state regulators continued filing breach notices as more information about the incident became available.
- Oct. 2, 2026: A Texas filing reported 19,929,149 people affected, including 2,992,244 Texans.
- Oct. 5, 2026: Bloomberg Law reported that the breach had affected nearly 20 million people, based on the new Texas filing.
- Oct. 8, 2026: We published its latest report on the incident, highlighting the nearly 20 million affected people.
What information was exposed
Cerner’s sample notification letter filed with California regulators said the affected information could include names, Social Security numbers, medical record numbers, doctors, diagnoses, medicines, test results, images, and care and treatment details. ThreatCluster also reported that exposed information included addresses.
“The personal information involved in this incident may have included your name, Social Security number, and information included within patient medical records, such as medical record numbers, doctors, diagnoses, medicines, test results, images, care and treatment.”
Cerner
Petronella Technology Group separately described the exfiltrated information as including names, dates of birth, and medical identifiers. Its analysis said the data set was stored on a cloud platform originally intended to be isolated from the public internet and attributed the exposure to privilege escalation and misconfigured network segmentation rather than a single software flaw. It also characterized the issue as a lapse in enforcing least-privilege principles.
Petronella Technology Group also said Oracle’s incident response team detected anomalous data transfer activity through internal monitoring, notified affected parties, and began a forensic investigation. The company’s analysis recommended vendor data inventories, verification of vendor security controls and Business Associate Agreements, continuous monitoring, formal incident response procedures, regular penetration testing, and documentation of vendor risk remediation.
State filings reveal the scope
The Texas attorney general Ken Paxton’s data breach portal, in an entry published October 2, lists 2,992,244 affected Texans. Breach notifications filed in South Carolina and Washington list roughly 283,000 and 69,000 affected residents, respectively.
Filings with Oregon regulators give January 22 through April 1, 2025, as the breach period and February 20, 2025, as the discovery date. The nearly 20 million figure is therefore substantially larger than the counts shown in individual state filings and earlier patient notifications.
At least 29 healthcare organizations have been affected, with estimates that as many as 80 may be involved. The FBI is investigating the incident.
If confirmed, the nearly 20 million figure would make the incident one of the largest healthcare data breaches on record in the United States. The 2024 Change Healthcare breach affected 192.7 million people.
Oracle has notified affected healthcare customers and initiated an investigation, but it has not issued a public statement confirming the overall number of people affected. The state filings and customer notices continue to provide the clearest available detail on the exposed information and the incident timeline.
Sources
About the Author
