Oracle Health: the 2025 breach is now ~20 million people
The Oracle Health breach tally quietly climbs to nearly 20 million patients
Stolen logins on two legacy Cerner servers in early 2025. The true size only surfaced through a Texas attorney-general filing: 19.9 million people, with SSNs, diagnoses, medications and medical images. Oracle still hasn't published a total.
- Disclosed
- Oct 5, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- ~19.9M patients of legacy Cerner clients in the US, at least 29 hospitals and health systems
- cerner
- In the wild
- Yes
- Data stolen in 2025; this is the updated count
The one-sentence version
Someone logged into two old Cerner servers that never got moved to the cloud, and walked out with the medical records of about one in seventeen Americans.
What happened
This is an old breach whose size kept growing. In January 2025 someone used stolen credentials to get into two legacy Cerner servers that had not yet been migrated to Oracle Cloud. The servers held data from hospitals and health systems that use Cerner’s electronic health records.
Oracle never published a total. The number came out through state filings: on October 2, 2026 a filing with the Texas attorney general put it at 19.9 million people. HIPAA Journal notes that the figure is not independently verified, and the federal HHS breach portal still shows a placeholder.
Exposed data includes names, Social Security numbers, addresses, diagnoses, medications, test results, medical images, medical record numbers and physician names. Lawsuits are ongoing.
No primary source here: neither Oracle nor the Texas AG has commented publicly. If you can link the filing itself, please open a pull request.
Crime-scene timeline
Jan 22, 2025
Intrusion into two legacy Cerner servers
Through stolen credentials. Oregon lists the exposure window as Jan 22 to Apr 1, 2025.
Feb–Mar 2025
Oracle discovers it
Discovery is reported as Feb 20 or Mar 7, 2025.
~Mar 31, 2025
Oracle starts quietly notifying hospital clients
Oct 2, 2026
Updated total filed with the Texas attorney general
19.9 million people, including 2,992,244 Texans.
Oct 5, 2026
Bloomberg reports “nearly 20 million”
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- HIPAA Journal19.9M per Texas AG filings; total not independently verified; HHS OCR still shows a placeholder
- Becker's Hospital ReviewReports the near-20M figure
- BankInfoSecurityBreach figure history
- Yahoo Finance / BloombergBloomberg's Oct 5 report