# Oracle Health Breach Grows to 19.9 Million People in Texas Filings

- URL: https://usa-24.com/oracle-health-data-breach-texas-filings/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-17T23:13:09.939Z
- Updated: 2026-10-17T23:13:09.947Z
- Topics: Oracle Health, Data Breaches, Healthcare Cybersecurity, Cerner, Medical Identity Theft

> Texas attorney general filings now put the Oracle Health breach at about 19.9 million people, one of the largest US healthcare data breaches on record. The intrusion ran from January to April 2025.

## Key takeaways

- The Oracle Health data breach now affects about 19.9 million people, according to Texas attorney general filings reported by Becker's on October 16.
- The intrusion began January 22, 2025, and ended April 1, 2025, and the filings list credential compromise as the cause.
- Exposed data includes addresses, Social Security numbers and medical information, which raises identity theft and medical fraud risk.
- Cerner's first filing in July 2025 listed nearly 2 million people, and later filings pushed the total to roughly 20 million.
- Oracle has not publicly confirmed the total, and the federal HHS portal still shows a placeholder of 501 individuals.

## What the Oracle Health data breach exposed

The Oracle Health data breach from 2025 now affects about 19.9 million people, according to filings with the Texas attorney general that [Becker's Hospital Review](https://www.beckershospitalreview.com/healthcare-information-technology/ehrs/oracle-health-breach-exposed-data-of-nearly-20-million-people-report/) obtained through a public records request. That makes it one of the largest US healthcare data breaches on record, and it surfaced about 21 months after the intrusion began.

[Bloomberg](https://finance.yahoo.com/healthcare/articles/oracle-2025-health-breach-compromised-230919298.html) first reported the nearly-20-million figure on October 5. Becker's followed on October 16 with the state filings. This is a new development on an older story, not a fresh attack.

The filings say the intrusion began January 22, 2025, and ended April 1, 2025. They list credential compromise as the cause. The affected systems were older Cerner servers whose data had not yet been migrated to Oracle's cloud. Exposed information includes addresses, Social Security numbers and medical information.

## How the count grew from 2 million to 19.9 million

Cerner's first filing in July 2025 listed nearly 2 million people. The count has since grown roughly tenfold. A July 2026 supplemental filing raised the total to 18.6 million, and a filing submitted September 30 added about 1.4 million more.

| Filing or report | Date | Reported total |
|---|---|---|
| Initial Texas filing | July 2025 | Nearly 2 million |
| Supplemental filing | July 2026 | 18.6 million |
| Filing submitted | September 30, 2026 | About 1.4 million added |
| Bloomberg first report | October 5, 2026 | Nearly 20 million |
| Becker's report on Texas filings | October 16, 2026 | 19.9 million |

The Texas attorney general received an updated total on October 2, according to the [HIPAA Journal](https://www.hipaajournal.com/oracle-health-data-breach/), which reported the figure as almost 20 million. The reported increments and totals do not line up exactly, so readers should treat the rounded figures as provisional until the primary filings are checked. The pattern still matters. Each new filing pushed the number higher, which suggests the scope was not clear when the first notices went out.

## Which states and patients are affected

The core group is patients at Cerner-powered hospitals and health systems. The HIPAA Journal's review of state filings names four states: about 2,992,244 Texas residents, 1,978,661 Oregon residents, 283,903 South Carolina residents and 69,238 Washington residents. Those four figures add up to roughly 5.3 million, so most of the 19.9 million total sits outside the states named in the sources. Residents of other states should check their attorney general's breach listings.

The data types matter as much as the head count. Social Security numbers paired with medical records give criminals what they need to open accounts in a patient's name and to file false insurance claims. The first sign of medical identity fraud is often a statement for care you never received, which is why consumer guidance points readers to their medical statements and explanation-of-benefits forms, according to [CyberGuy](https://cyberguy.com/security/oracle-health-data-breach-exposes-20-million-patients/).

Hospitals and clinics also carry a burden. Their patients are the ones receiving letters, calls and questions, and their vendor relationships are now under scrutiny.

## How to check whether your provider used Cerner

Start with the organization that treated you, not with Oracle. A notice from your provider is the most reliable signal that your records were involved.

1. Ask your hospital, clinic or health system whether it uses Cerner systems and whether it has sent you a breach notice. Providers that use Cerner should also confirm whether they have received notices from the vendor.
2. Read any breach letter closely. Note the dates of care it names, the data types it lists and the contact number it provides.
3. Review medical bills and explanation-of-benefits forms for visits, tests or prescriptions you do not recognize. Dispute errors in writing with your insurer and provider.
4. Check your credit reports for accounts you did not open. Consider a credit freeze with Equifax, Experian and TransUnion, which is free to place and lift.
5. Keep copies of every letter, bill and call record. If fraud appears later, a clear paper trail speeds up disputes.

## Why the breach took 21 months to surface

Texas law requires companies to notify the attorney general within 30 days of determining that a breach affects at least 250 state residents, and the office posts those filings publicly, according to [SOFX](https://www.sofx.com/oracle-health-cyber-breach-exposes-20-million-records-linked-to-dod-and-va-systems/). That public posting is how the nearly-20-million figure reached reporters, roughly 21 months after the intrusion.

Public filings were not the first signal. In March 2025, a hacker began posting data that appeared linked to Oracle's cloud. The company rejected that claim and said its cloud was safe, according to a [summary of eSecurity Planet reporting](https://www.under30ceo.com/healthcare-data-breach-oracle-health-20-million/). Notification to some providers came later, partly because law enforcement asked for a delay.

Commentators have focused less on the attack itself and more on the gap between the private notices of 2025 and the scale disclosed in 2026, as [Tech Insider](https://tech-insider.org/oracle-health-breach-20-million-people-2026/) notes. The reported method was stolen credentials used against legacy servers that had not moved to Oracle's cloud. That is a familiar weakness: older systems often lag newer infrastructure in protection, and a single login can reach more data than its owner expects.

## Open questions and what comes next

Several basic facts remain unsettled. Becker's cites February 20, 2025 as the discovery date, while the HIPAA Journal says Oracle identified the breach on March 7, 2025. Sources also do not explain how attackers obtained the credentials or why one login opened data across several healthcare organizations. How much data was copied, and who carried out the attack, remain unclear.

Oracle has not publicly confirmed the nearly-20-million total. One outlet reports that the company declined to comment on the Bloomberg figure, according to [The420.in](https://the420.in/oracle-health-cerner-data-breach-nearly-20-million/). The Texas attorney general has withheld correspondence from Cerner's attorneys that lists affected organizations, and it has asked its Open Records Division to rule on whether those records can be released.

Watch three things. The first is the Open Records ruling, which could identify the organizations behind the filings. The second is the HHS Office for Civil Rights portal, which still lists a placeholder of 501 individuals and is expected to update in the coming weeks. The third is whether Oracle issues a statement that matches the state totals. The federal number, when it arrives, will show whether the 19.9 million figure holds up.

## Frequently asked questions

### Was my data included in the Oracle Health data breach?

Your data could be included if you received care at a Cerner-powered hospital, clinic or health system whose information sat on the affected older servers. Ask your provider whether it uses Cerner and whether it has sent you a breach notice. Any letter you receive should list the data types involved.

### How many people did the Oracle Health data breach affect?

Texas attorney general filings reported by Becker's put the total at about 19.9 million people. The count rose from nearly 2 million in Cerner's first July 2025 filing through later supplements. Oracle has not publicly confirmed the figure.

### What information was exposed in the Oracle Health breach?

Filings say addresses, Social Security numbers and medical information were exposed. The intrusion began January 22, 2025, and ended April 1, 2025, and the filings list credential compromise as the cause.

### Should I freeze my credit after the Oracle Health breach?

A credit freeze is a reasonable step if your Social Security number may have been exposed. It blocks most new accounts from being opened in your name and is free to place and lift. Review medical bills and explanation-of-benefits forms as well.

## Sources

1. [Oracle Health breach exposed data of nearly 20 million people: Report — Becker's Hospital Review](https://www.beckershospitalreview.com/healthcare-information-technology/ehrs/oracle-health-breach-exposed-data-of-nearly-20-million-people-report/)
2. [Oracle 2025 Health Breach Compromised Data of 20 Million People — Bloomberg via Yahoo Finance](https://finance.yahoo.com/healthcare/articles/oracle-2025-health-breach-compromised-230919298.html)
3. [Almost 20 Million Individuals Affected by 2025 Data Breach at Oracle Health/Cerner — HIPAA Journal](https://www.hipaajournal.com/oracle-health-data-breach/)
4. [Oracle Health Cyber Breach Exposes 20 Million Records Linked to DoD and VA Systems — SOFX](https://www.sofx.com/oracle-health-cyber-breach-exposes-20-million-records-linked-to-dod-and-va-systems/)
5. [Healthcare Data Breach Hits Nearly 20 Million: Founder Playbook — Under30CEO (citing eSecurity Planet)](https://www.under30ceo.com/healthcare-data-breach-oracle-health-20-million/)
6. [Oracle Health Breach Victim Count Climbs Toward 20 Million After New Filings — The420.in](https://the420.in/oracle-health-cerner-data-breach-nearly-20-million/)
7. [Oracle Health Breach Exposes Nearly 20M People [2026] — Tech Insider](https://tech-insider.org/oracle-health-breach-20-million-people-2026/)
8. [Oracle Health data breach exposes nearly 20 million patients — CyberGuy](https://cyberguy.com/security/oracle-health-data-breach-exposes-20-million-patients/)