A 2025 data breach involving Oracle Health’s legacy Cerner servers compromised personal and medical data of about 20 million people, including approximately 3 million Texans, based on information reported in October 2026.
The Texas Attorney General disclosed information indicating that the breach affected almost 20 million people. The breached data included medical data, addresses, and Social Security numbers. Oracle Health has not announced to the public the total number of people affected or the number of Cerner clients who had their information compromised. The complete details of the incident have not been confirmed through Oracle Health’s public disclosures.
Information reported by healthcare organizations affected by the incident indicates that the types of compromised data varied among patients. The information could include names, Social Security numbers, doctor names, diagnoses, prescription drugs, test results, and other medical data. The affected information was saved on legacy servers connected with Cerner, the electronic health record company bought by Oracle in 2022. The servers had not been moved to Oracle Cloud when the incident occurred.
Unauthorized Access to Legacy Cerner Servers
Oracle notified some customers about the cyberattack in March 2025. The company mentioned that the incident happened some time after January 22, 2025, and involved unauthorized access to older Cerner servers. Oracle Health identified the security breach on March 7, 2025. The Oregon Attorney General listed the breach as occurring on January 22, 2025, through April 1, 2025.
The incident involved two legacy servers from Cerner that were not yet transferred to Oracle Cloud. The compromised data had not yet been transferred to Oracle Health’s cloud storage service.
State-Level Reporting Identifies Affected Individuals
State breach disclosures have identified individuals affected by the incident. The reported figures include 2,992,244 individuals in Texas, 1,978,661 individuals in Oregon, 283,903 individuals in South Carolina, and 69,238 individuals in Washington. These state figures provide documented counts of affected residents. They do not establish the complete number of individuals affected nationwide.
The U.S. Department of Health and Human Services Office for Civil Rights breach portal continued to list a placeholder total of 501 individuals affected by the cyberattack. The portal had not posted new updates as described in the October 2026 report.
Responsibilities of Affected Healthcare Organizations
Oracle Health previously informed healthcare provider customers that each affected organization was responsible for determining whether the incident constituted a reportable breach under HIPAA. The affected organizations were also responsible for issuing notifications to individuals when required. The breach involved information associated with patients receiving care from healthcare organizations that used Oracle Health’s services. The compromised information varied by provider and patient.