Oracle Health Breach of Old Cerner Servers Exposed Data on Nearly 20 Million People, Including 3 Million Texans

Oracle Health Breach of Old Cerner Servers Exposed Data on Nearly 20 Million People, Including 3 Million Texans

According to the Texas report, the exposed data included Social Security numbers, addresses, and medical information, Gizmodo reported, citing Bloomberg. Hospitals that have notified patients say the details vary by person and may also include treating doctors, diagnoses, medications, and test results. For many families, a hospital letter about the Oracle Health or Cerner incident may be the only notice they receive.

According to Bloomberg Línea, the Texas report said Oracle itself disclosed the total. Oracle declined to comment on the figure, and the Texas attorney general’s office did not respond to Bloomberg’s requests for comment. Oracle bought the health records company Cerner for $28 billion in 2022.

Its 2025 notice to affected customers, signed by Oracle Health executive Seema Verma and first reported by BleepingComputer, said: “We are writing to inform you that, on or around February 20, 2025, we became aware of a cybersecurity event involving unauthorized access to some amount of your Cerner data that was on an old legacy server not yet migrated to the Oracle Cloud.” Oracle said an intruder used compromised customer credentials to get in sometime after Jan. 22, 2025, and copied data to a remote server. Oracle told hospitals it would not notify patients directly.

Each hospital had to decide whether federal privacy law required notice, though Oracle agreed to pay for credit monitoring and a mailing vendor. BleepingComputer’s sources said a person using the name “Andrew” was trying to extort affected hospitals for millions of dollars in cryptocurrency. That same month, Oracle publicly denied a separate hacker claim, saying, “There has been no breach of Oracle Cloud.”The health breach involved a legacy server that had not yet been moved to that cloud, a distinction that meant little to patients whose records were taken.

The scale stayed hidden partly because federal law enforcement asked affected organizations to delay patient notices while it investigated, according to hospital notices. Bloomberg reported in March 2025 that the FBI was investigating the theft and the extortion attempts. The result has been a slow trickle of letters, sent hospital by hospital and sometimes many months after the theft.

Baltimore’s LifeBridge Health said in a notice to its patients that Oracle gave it a list of affected patients on Sept. 19, 2025. Texas-based CHRISTUS Health said Oracle notified it in October 2025 and sent a patient list on Dec.

9, 2025. CHRISTUS said the affected laboratory data all predates February 2025. In the Kansas City area, NKC Health posted a patient notice on Nov.

25, 2025, and Mosaic Life Care in St. Joseph, Missouri, also notified patients, The Beacon reported. Elena A.

Belov, a lawyer with Almeida Law Group who represents patients in a federal class action filed in the Western District of Missouri, said Oracle’s attorneys told her that 80 hospitals’ patient records may be involved. “This is one of the most massive breaches in the health care industry in the last couple of years,” Belov said. The patients most likely to be affected are those treated at hospitals or labs that used legacy Cerner systems before early 2025.

Oracle’s health clients also include the Defense Department and the Department of Veterans Affairs. A VA spokesperson said in March 2025 that the department was not affected, and the impact on other federal customers has not been made clear. Affected hospitals are offering two years of free credit monitoring and identity protection, and some, such as LifeBridge, also offer minor identity protection services.

AdventHealth’s notice said, “This incident has not impacted AdventHealth’s current IT systems or the safe and reliable operation of our clinical services.” Letters include an engagement number that patients use when they call the toll-free help line. Readers who receive a letter can enroll in the free monitoring and, as hospital notices advise, review statements from providers and insurers and report any visit, prescription or test they do not recognize. A credit freeze with the major credit bureaus can also block new accounts opened in a stolen name.

People who have not received a letter should not assume they are unaffected. Oracle has not published a list of affected hospitals, and notices are still arriving one health system at a time. Oracle has not said publicly how many hospitals were involved, whether every affected patient has been notified, or whether the stolen data was sold or leaked.

The sensible response is calm verification. Keep any hospital letter, call only the number printed on it, and be wary of unsolicited calls or emails that mention the breach. A notice does not mean fraud has happened, but it is worth a few minutes of checking.

What happened in the Oracle Health breach? An intruder used compromised customer credentials to reach old Cerner servers that had not yet been moved to Oracle Cloud, sometime after Jan. 22, 2025.

Oracle said it learned of the event around Feb. 20, 2025, and began warning hospital customers in March 2025. Where does the 20 million figure come from?

It comes from a Texas attorney general report that cited Oracle’s own disclosure, as described by Bloomberg on Oct. 5, 2026. Oracle declined to comment on the number.

What information was exposed? It varies by person. The Texas report cited Social Security numbers, addresses and medical information, and hospital notices add items such as doctors, diagnoses, medications, test results and images.

How will I know if my data was involved? Affected hospitals, not Oracle, are mailing letters. The letters include an engagement number and a toll-free number for enrolling in free credit monitoring.

Should I freeze my credit? A freeze is a reasonable step for anyone who receives a notice. Checking insurance statements for unfamiliar care can also catch misuse early.

Were veterans or military families affected? The VA said in March 2025 that it was not affected. The impact on other federal customers, including the Defense Department, has not been publicly clarified.