Oracle Health's breach of older Cerner servers now counts nearly 20 million people, and the total climbed for more than a year as state filings came in. About 3 million of them are Texans. The Oracle Health data breach reached patient records that had not yet moved to Oracle's cloud, and the exposed information includes Social Security numbers stored alongside medical details.
Becker's Hospital Review, which obtained Texas attorney general filings through a public records request, reported the figure as 19.9 million people in its report. Bloomberg first reported the nearly 20 million figure on October 5, days after a Texas filing dated October 2, in a story syndicated on Yahoo Finance. The breach itself is more than a year old, but the count, the lawsuits and the open questions are still moving.
What the Oracle Health data breach exposed
Reporting says the records include Social Security numbers, addresses and medical information such as diagnoses, prescriptions and test results, according to HIPAA Journal and CyberGuy. That mix is what makes this breach more serious than a simple card-number leak. A Social Security number paired with a medical history can support medical identity theft, where someone uses a victim's identity to obtain care or bill insurance, on top of the ordinary financial fraud most people picture.
Most patients have never heard of Oracle Health. The company is the rebranded Cerner, one of the largest electronic health record vendors, and many hospitals run its software. Oracle acquired Cerner in 2022 for $28 billion. A patient can have records in that system without ever dealing with the vendor directly.
Texas has the clearest public count. The state's attorney general breach portal lists Cerner Corp., now Oracle Health, as reporting nearly 3 million affected Texans, and one tally puts the figure at 2,992,244. An earlier July 2025 filing listed 4,082 Texans within a total of nearly 2 million people. Most of the affected people live in states beyond Texas, so residents elsewhere should not assume they are outside the exposure.
USA 24 has covered other large exposures in recent reporting, including a hacktivist group's searchable database of 41,000 DHS staff records and an open CitySourced database that held 42 million documents. Those cases show how quickly stored data can become a searchable target. The Oracle Health breach followed a different path, through a vendor's older servers.
How the count grew to nearly 20 million
The total did not appear in a single filing. The first state count, in July 2025, listed about 2 million people. Later supplements and filings pushed the number far higher.
| Filing | What it reported |
|---|---|
| July 2025 original filing | About 2 million people, including 4,082 Texans |
| July 2026 supplement | Raised the total to 18.6 million |
| September 30 filing | Added about 1.4 million more |
| October 2 Texas filing | Reported by Bloomberg on October 5 at nearly 20 million |
Because later figures come from filings that can overlap, reporting treats the nearly 20 million total as a reported figure rather than a single audited number. HIPAA Journal said the total has not been independently verified. Public counts have been uneven, and state and HHS reporting has lagged behind the breach itself.
How the intrusion unfolded and what Oracle told hospitals
Filings say the intrusion began January 22, 2025, and was discovered February 20, 2025. It ended April 1, 2025. That gave attackers about four weeks inside the systems before anyone noticed, according to OpenClassActions.
Filings list compromised credentials as the cause. Oracle told some healthcare customers in March 2025 that attackers had reached older Cerner servers whose data had not yet moved to Oracle's cloud, according to Becker's and the Bloomberg report on Yahoo Finance. The disclosure went to hospitals first, which is why most of the public learned about the breach through state filings rather than a single national announcement.
Medical Daily reported that Oracle told hospitals it would not notify patients directly, according to its coverage of the breach. If that holds, the notification burden falls on each hospital and on state filings, which helps explain why patients may hear about the breach late or from a provider.
Lawsuits and the liability question
A consolidated patient class action in federal court in Missouri has survived most motions to dismiss. A June 22 ruling let the case proceed against Oracle Health and eight health systems. According to Becker's, the ruling said hospitals cannot simply contract that duty away.
Other suits name individual hospitals. A suit against ChristianaCare in Delaware is one example, and Huntsville Hospital in Alabama was named in a new federal lawsuit. Rocket City Now reported that Oracle did not respond to a request for comment on a related lawsuit. USA 24 did not find an on-record statement from Oracle Health about this breach.
The liability question matters beyond this case. Hospitals buy software from vendors and sign contracts that divide responsibilities, but the June ruling suggests a health system cannot hand off its duty to protect patient data simply because a vendor runs the servers. If that position holds, hospitals may look harder at how vendors protect legacy systems, and patients may gain a clearer path to recovery. The timing of any settlement remains unclear.
What affected patients should do now
The steps below are general guidance drawn from reporting, not official instructions.
- Check for a notice. Look for letters or emails from Oracle Health, Cerner or any hospital where you received care. If you cannot tell which system held your records, call the provider's patient line and ask.
- Freeze your credit. A freeze at the three credit bureaus is free, and CyberGuy's reporting points to it as a first defense against financial fraud.
- Review medical bills and explanation-of-benefits statements. Look for visits, procedures or prescriptions you did not receive, and report errors to your insurer in writing.
- Treat unexpected messages with suspicion. Watch for phishing that references the breach. Verify any contact by calling the organization on a number you already have, not one included in the message.
Open questions that could change the count
Several figures in circulation still need checking. Becker's cites 19.9 million, while other outlets say nearly 20 million, and the total depends on state filings that have not been independently verified. One source lists a placeholder of 501 on the HHS portal, which is likely outdated and still needs verification.
A Rescana post describes the breach with 2026 dates, which conflicts with the 2025 dates in the Texas filings. USA 24 treats that page as unreliable until its details can be confirmed.
Other unknowns matter for readers. It is not clear whether other state attorneys general will publish their own counts, or whether Oracle will offer patient-level notices or credit monitoring at scale. The litigation is active, and settlement timing is still unclear.
What comes next for patients and the courts
Three developments are worth watching. First, whether other states publish their own counts, which would show whether the nearly 20 million figure holds or grows. Second, whether the HHS breach portal updates the total and clears the placeholder. Third, how the Missouri class action moves toward a ruling or settlement, since the June decision set the terms of the liability fight.
For patients, the practical question is simpler. Will a letter arrive, and will it come from Oracle Health, Cerner or the hospital that holds the chart?
