The Oracle Health breach of old Cerner servers now reaches nearly 20 million people, Bloomberg reports

Nearly 20 million people are now caught up in the Oracle Health breach of legacy Cerner servers, according to a figure that Bloomberg attributed on Oct. 5 to the Texas attorney general’s office. Oracle has not publicly confirmed that total and declined to comment to Bloomberg. The data involved may include names, Social Security numbers and detailed medical information, and the intrusion itself dates to early 2025.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

Unauthorized access began after Jan. 22, 2025, Oracle said it became aware of the event on or around Feb. 20, 2025, and the window listed in an Oregon filing closes on Apr. 1, 2025. The long gap between those dates and the October 2026 tally is the story of how a breach on a server Oracle called a legacy system turned into one of the largest health-data counts on record.

The legacy Cerner server that had not moved to Oracle Cloud

Oracle’s own notice to customers, reported by BleepingComputer on March 28, 2025, described “unauthorized access” to Cerner data on “an old legacy server not yet migrated to the Oracle Cloud.” The company said the intruder used compromised customer credentials and copied data to a remote server. The notice was signed by Seema Verma, executive vice president and general manager of Oracle Health, and it told hospitals that they, not Oracle, must decide whether HIPAA applies and whether patients need to be notified. Oracle offered to pay for credit monitoring and the mailing vendor but not to send letters on the hospitals’ behalf. Customers told BleepingComputer that Oracle steered them to its Chief Information Security Office by phone rather than email and provided no written reports, and that Oracle said the stolen data “may” have included electronic health record patient information, while multiple sources said patient data was in fact taken.

Oracle’s public stance at the time was different. Gizmodo recounted that after a hacker using the handle rose87168 posted data from Oracle’s single sign-on system in March 2025, Oracle said there had been no breach of Oracle Cloud, a denial that BleepingComputer’s later reporting suggested may be explained by the data sitting on a legacy server not yet moved to the cloud. Cerner joined Oracle in June 2022 in a deal valued at roughly $28.3 billion.

What the state breach filings actually show

The SecurityWeek report walks through the regulatory trail. Cerner’s entry on the Texas attorney general’s portal, published Oct. 2, lists 2,992,244 affected Texans. South Carolina’s filing covers roughly 283,000 residents and Washington’s roughly 69,000. Oregon’s lists breach dates but no count in that reporting, and California received a sample notification letter without a figure. The Oregon filing gives Jan. 22, 2025 as the earliest date of unauthorized access, Feb. 20, 2025 as the discovery date and Apr. 1, 2025 as the end of the breach window. Those state numbers are far smaller than the national total, and the reporting does not reconcile the two, so each state portal entry shows only the slice of residents that state regulators track.

The state filings are searchable on the Texas attorney general’s data security breach reports page, where a Cerner entry of this kind is listed. It is a lookup page for the filings, not a source for the 20 million total, which rests on the Bloomberg report and the attorney general’s statement to that outlet.

How the nearly 20 million figure was reported

Bloomberg reported on Oct. 5 that the Texas attorney general’s office said data on about 20 million people was involved, with exposed details reportedly including medical information, addresses and Social Security numbers. eSecurity Planet notes that the filing is cited secondhand and that nothing explains exactly how the count was calculated or how much data was copied. The gap between a Texas count near 3 million and a total near 20 million is therefore unexplained in public reporting, which is why the figure should be read as reported rather than confirmed by Oracle.

If the total holds, SecurityWeek says it would be among the largest U.S. healthcare breaches, though still well short of the 192.7 million people affected by the Change Healthcare attack in 2024. Bloomberg also noted that Oracle’s medical clients include the Department of Defense and the Department of Veterans Affairs.

Extortion, delayed notices and the data at stake

The sample letter filed in California says the data may include names, Social Security numbers and medical details such as medical record numbers, doctors, diagnoses, medicines, test results, images, and care and treatment records. BleepingComputer’s sources said hospitals were being extorted by an individual calling himself “Andrew,” who demanded a large sum in cryptocurrency and set up public websites to pressure victims. That actor has not claimed ties to any known ransomware or extortion group.

Notification was slow. In March 2025 a separate threat actor also claimed to hold LDAP authentication data on 6 million people from Oracle Cloud’s single sign-on servers, a claim Oracle denied even as customers reportedly confirmed that sample records were valid, according to BleepingComputer’s sources; that claim is distinct from the Cerner legacy-server intrusion. According to eSecurity Planet, one health system, LifeBridge, received its list of affected patients in September 2025, and law enforcement had asked that patient notifications be delayed. Because Oracle left the notification decision to each hospital, the public count has depended on individual customers and state regulators posting their own entries rather than on one announcement from the vendor, and Oracle declined to comment when Bloomberg asked about the total.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.