Oracle Health data breach exposes nearly 20 million patients

When you visit a doctor or hospital, you expect your medical information to stay private. After all, your health records can reveal some of the most personal details about your life. Now, a involving Oracle Health is raising serious questions about how well that information is protected.

Nearly 20 million people reportedly had their personal and medical information compromised in a cyberattack involving older Cerner systems. The attack dates back to early 2025, but new details about its reach are still emerging. For patients, the concern goes well beyond stolen passwords. Hackers may have obtained Social Security numbers, diagnoses and even medical images.

Join our upcoming CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money

In this free live online class, Kurt "CyberGuy" Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season. Youll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.

Join us Saturday, October 31, at 11 AM ET / 8 AM PT. Register free now at CyberGuyLive.com.

MEDICAL IDENTITY THEFT FOLLOWS YOU INTO THE DOCTOR'S OFFICE

The Oracle Health data breach appears to be much larger than earlier patient notifications suggested. According to figures reported in filings with the Texas Attorney General, the personal and medical information of approximately 19.9 million people was compromised in a cyberattack involving legacy Cerner systems. The Texas Attorney General's official data breach portal published Cerner's entry on October 2, 2026. It lists 2,992,244 affected Texas residents. The nationwide figure reported in connection with the filing is 19,929,149 people.

Oracle has not separately confirmed the nationwide total in a public statement. Still, the reported scale would place this incident among the largest healthcare data breaches in U.S. history. The attack involved older systems belonging to Cerner, an electronic health records company Oracle acquired in June 2022 for approximately $28.3 billion. The business now operates as Oracle Health. Cerner's technology helps hospitals and healthcare providers manage patient information. As a result, unauthorized access to those systems can expose records belonging to patients across multiple healthcare organizations.

The trouble began in early 2025. Oracle started notifying affected healthcare customers in March after discovering unauthorized access involving older Cerner systems. According to Oracle's customer communications, the company became aware of the incident around February 20, 2025. Investigators found evidence suggesting that an attacker used stolen customer credentials to access a legacy server sometime after January 22. The attacker then copied information to a remote server.

The server had not yet been migrated to Oracle Cloud. However, investigators have not publicly established that the server's age caused the breach. The precise way the attacker obtained the stolen credentials also remains unclear. This raises an uncomfortable question. How much sensitive patient information remains on older healthcare systems, even after a major technology company takes ownership?

The attacker allegedly tried to turn the stolen information into a multimillion-dollar payday. According to earlier BleepingComputer reporting, an individual using the name "Andrew" contacted affected hospitals and demanded cryp