Nearly 20 million people had personal and medical data exposed in the 2025 attack on Oracle Health’s old Cerner servers, according to a figure drawn from an entry on the Texas attorney general’s breach portal. Bloomberg reported the number on October 5, 2026, and it dwarfs every count that came before it.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
Oracle has not confirmed the total and declined to comment to Bloomberg. That leaves a breach first disclosed in a quiet customer notice more than a year and a half ago still being measured in pieces, one state filing at a time, while the federal government’s own breach portal lags far behind.
The Texas filing behind the 20 million figure
SecurityWeek’s account of the Bloomberg report says Cerner’s entry on the Texas attorney general’s portal was published on October 2, 2026, and lists 2,992,244 affected Texans. The nearly 20 million total is Bloomberg’s figure based on that filing, and it is higher than counts in earlier filings and patient notifications. South Carolina residents number roughly 283,000 and Washington roughly 69,000 in the same reporting, a reminder that each state sees only its own slice.
The growth has been steep. A July 2026 report from teiss described a Texas state filing that then put the number at 2,658,388, which was already described as the first time Oracle Health had quantified the breach. Three months later the same state portal carried a total more than seven times larger.
The gap between the reported figure and what the public filings itemize is itself notable. Paubox, citing HIPAA Journal, lists Texas at 2,992,244, Oregon at 1,978,661, South Carolina at 283,903 and Washington at 69,238, which adds up to about 5.3 million across four states. The rest of the nearly 20 million is not broken out in the reporting reviewed here, so the Texas portal entry is the only document that carries the full total, and readers should treat the number as reported rather than audited.
How attackers reached the legacy servers
Oracle’s own notice, as described by SecurityWeek, referred to unauthorized access to some amount of Cerner data on an old legacy server that had not yet been migrated to the Oracle Cloud. Oracle said the evidence suggested an attacker used stolen customer credentials to reach the server after January 22, 2025, and copied data to a remote server. The company became aware of a cybersecurity event “on or around February 20, 2025,” according to the same notice. Oregon filings list the breach window as January 22 through April 1, 2025.
Cerner became part of Oracle in June 2022 in a deal valued at roughly $28.3 billion, and the business now operates as Oracle Health. BleepingComputer’s March 2025 report said the notice to customers was signed by Seema Verma, executive vice president and general manager of Oracle Health, and that Oracle told hospitals it was up to them to decide whether federal health privacy rules required notifying patients, though Oracle offered to help identify affected individuals and provide templates.
What was taken and who tried to profit
A sample notification letter that Cerner filed with California regulators says the exposed information may have included a patient’s name and Social Security number, along with medical record numbers, doctors, diagnoses, medicines, test results and images. That combination is what makes the breach more serious than a stolen password list: a Social Security number supports identity theft, and a diagnosis cannot be changed after it leaks.
BleepingComputer’s sources said hospitals were being extorted by an individual calling himself or herself “Andrew,” who had not claimed ties to any known ransomware group. The actor demanded millions of dollars in cryptocurrency and set up public websites about the breach to raise the pressure. Oracle agreed to pay for credit monitoring and a mailing vendor, but reportedly would not send notices on the hospitals’ behalf.
A tally that arrived in pieces
The structure of the response explains the slow count. Each hospital client files separately, so the picture assembles slowly. Paubox’s analysis notes that state filings in August 2025 totaled just 14,485 people, that some hospital clients received affected-patient lists only in November 2025, and that the federal health department’s breach portal still lists the incident as 501 people in October 2026. It adds that Oregon’s filing was 1,978,661 and that the breach touched up to 80 hospitals. Paubox stresses that the 20 million figure comes from state filings reported by Bloomberg and has not been independently verified.
Even so, eSecurity Planet reports the same Texas attorney general figure and notes that patient data from multiple healthcare organizations was involved. If the number holds, SecurityWeek says it would make this one of the largest healthcare data breaches on record, though still far smaller than the 2024 Change Healthcare attack, which affected 192.7 million people. Oracle began alerting healthcare customers in March 2025, so many patients first learn of an exposure from their hospital rather than from the vendor. Anyone who received care at a Cerner client around that time should watch for a notification letter, review credit reports and take up any free credit monitoring that is offered.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Doctors warn a silent liver disease now affects one in three American adults
- The FBI told the rest of ShinyHunters to surrender after a 24-year-old was arrested
- Two passengers died at an Ohio toll plaza, and the NTSB now wants the cash lanes shut
- Long use of a common prostate pill is tied to a higher chance of glaucoma
