Cybersecurity

Oracle Health Data Breach Impact Climbs to Nearly 20 Million

New state filings and reports reveal that a cyberattack impacting Oracle Health's legacy infrastructure has exposed the personal and medical records of nearly 20 million individuals.

Radwan AbdulhadiEditor and technology writer

Published: October 8, 2026 · Updated: October 8, 2026 · 4 min read

Oracle Health Data Breach Impact Climbs to Nearly 20 Million — Image: SecurityWeek

The Escalating Scale of the Oracle Health Incident

The personal and medical information of nearly 20 million people was compromised in a cyberattack targeting Oracle Health’s legacy Cerner systems early last year, according to a report from the Texas attorney general cited by Bloomberg. This updated figure is considerably higher than the initial counts that surfaced in earlier filings and patient notifications following the security event. Oracle has not issued a public statement addressing the total number of affected individuals and declined to comment on the disclosures to Bloomberg.

Electronic health record (EHR) vendor Cerner was originally acquired by Oracle in June 2022 through a transaction valued at approximately $28.3 billion. The business now operates under the Oracle Health banner. Following the breach, Oracle began notifying impacted healthcare customers in March 2025 about unauthorized access involving legacy data infrastructure.

Details of the Legacy Server Intrusion

In its notices sent to healthcare clients, Oracle explained the nature of the breach involving its older infrastructure. "We are writing to inform you that, on or around February 20, 2025, we became aware of a cybersecurity event involving unauthorized access to some amount of your Cerner data that was on an old legacy server not yet migrated to the Oracle Cloud," the notice stated.

According to findings shared with customers, available evidence indicated that an attacker utilized stolen customer credentials to gain access to the server sometime after January 22, 2025. Once inside, the unauthorized actor copied data to a remote server. Subsequent reports by BleepingComputer detailed that extortion demands aimed at affected hospitals originated from an individual threat actor operating under the moniker 'Andrew', with no established links to known ransomware or extortion gangs.

Extortion Tactics and State-Level Filings

To prevent the stolen sensitive information from being leaked or sold publicly, the hacker demanded millions of dollars in cryptocurrency. Furthermore, the individual set up public websites dedicated to the breach to amplify pressure on the affected organizations. Detailed records of the incident have steadily surfaced across various state regulatory portals.

Cerner's entry on the Texas attorney general's data breach portal, published on October 2, listed 2,992,244 impacted Texans. Additional breach notifications filed in South Carolina and Washington documented approximately 283,000 and 69,000 affected residents, respectively. Regulatory filings submitted in Oregon established the breach timeline as occurring between January 22 and April 1, 2025, with a formal discovery date noted as February 20, 2025.

Compromised Data and Historical Comparison

A sample notification letter filed by Cerner with California regulatory authorities outlined the specific categories of exposed data. "The personal information involved in this incident may have included your name, Social Security number, and information included within patient medical records, such as medical record numbers, doctors, diagnoses, medicines, test results, images, care and treatment," the notification read.

If confirmed, the nearly 20 million figure positions this incident among the largest healthcare data breaches documented in the United States. Only a select few reported security events have surpassed this scale, most notably the massive 2024 ransomware attack on Change Healthcare, which impacted an estimated 192.7 million people and underscored persistent vulnerabilities within the broader healthcare technology ecosystem.

Broader Implications for Healthcare Security

The escalating tally associated with the Oracle Health breach highlights ongoing concerns regarding legacy systems and third-party vendor security across the medical sector. As regulatory scrutiny increases and state filings reveal wider exposure, organizations continue to assess the risks tied to unmigrated data servers and credential-based intrusions.