Oracle Health Breach Grows to 19.9 Million People in Texas Filings

What the Oracle Health data breach exposed

The Oracle Health data breach from 2025 now affects about 19.9 million people, according to filings with the Texas attorney general that Becker's Hospital Review obtained through a public records request. That makes it one of the largest US healthcare data breaches on record, and it surfaced about 21 months after the intrusion began.

Bloomberg first reported the nearly-20-million figure on October 5. Becker's followed on October 16 with the state filings. This is a new development on an older story, not a fresh attack.

The filings say the intrusion began January 22, 2025, and ended April 1, 2025. They list credential compromise as the cause. The affected systems were older Cerner servers whose data had not yet been migrated to Oracle's cloud. Exposed information includes addresses, Social Security numbers and medical information.

How the count grew from 2 million to 19.9 million

Cerner's first filing in July 2025 listed nearly 2 million people. The count has since grown roughly tenfold. A July 2026 supplemental filing raised the total to 18.6 million, and a filing submitted September 30 added about 1.4 million more.

The Texas attorney general received an updated total on October 2, according to the HIPAA Journal, which reported the figure as almost 20 million. The reported increments and totals do not line up exactly, so readers should treat the rounded figures as provisional until the primary filings are checked. The pattern still matters. Each new filing pushed the number higher, which suggests the scope was not clear when the first notices went out.

Which states and patients are affected

The core group is patients at Cerner-powered hospitals and health systems. The HIPAA Journal's review of state filings names four states: about 2,992,244 Texas residents, 1,978,661 Oregon residents, 283,903 South Carolina residents and 69,238 Washington residents. Those four figures add up to roughly 5.3 million, so most of the 19.9 million total sits outside the states named in the sources. Residents of other states should check their attorney general's breach listings.

The data types matter as much as the head count. Social Security numbers paired with medical records give criminals what they need to open accounts in a patient's name and to file false insurance claims. The first sign of medical identity fraud is often a statement for care you never received, which is why consumer guidance points readers to their medical statements and explanation-of-benefits forms, according to CyberGuy.

Hospitals and clinics also carry a burden. Their patients are the ones receiving letters, calls and questions, and their vendor relationships are now under scrutiny.

How to check whether your provider used Cerner

Start with the organization that treated you, not with Oracle. A notice from your provider is the most reliable signal that your records were involved.

1. Ask your hospital, clinic or health system whether it uses Cerner systems and whether it has sent you a breach notice. Providers that use Cerner should also confirm whether they have received notices from the vendor.
2. Read any breach letter closely. Note the dates of care it names, the data types it lists and the contact number it provides.
3. Review medical bills and explanation-of-benefits forms for visits, tests or prescriptions you do not recognize. Dispute errors in writing with your insurer and provider.
4. Check your credit reports for accounts you did not open. Consider a credit freeze with Equifax, Experian and TransUnion, which is free to place and lift.
5. Keep copies of every letter, bill and call record. If fraud appears later, a clear paper trail speeds up disputes.

Why the breach took 21 months to surface

Texas law requires companies to notify the attorney general within 30 days of determining that a breach affects at least 250 state residents, and the office posts those filings publicly, according to SOFX. That public posting is how the nearly-20-million figure reached reporters, roughly 21 months after the intrusion.

Public filings were not the first signal. In March 2025, a hacker began posting data that appeared linked to Oracle's cloud. The company rejected that claim and said its cloud was safe, according to a summary of eSecurity Planet reporting. Notification to some providers came later, partly because law enforcement asked for a delay.

Commentators have focused less on the attack itself and more on the gap between the private notices of 2025 and the scale disclosed in 2026, as Tech Insider notes. The reported method was stolen credentials used against legacy servers that had not moved to Oracle's cloud. That is a familiar weakness: older systems often lag newer infrastructure in protection, and a single login can reach more data than its owner expects.

Open questions and what comes next

Several basic facts remain unsettled. Becker's cites February 20, 2025 as the discovery date, while the HIPAA Journal says Oracle identified the breach on March 7, 2025. Sources also do not explain how attackers obtained the credentials or why one login opened data across several healthcare organizations. How much data was copied, and who carried out the attack, remain unclear.

Oracle has not publicly confirmed the nearly-20-million total. One outlet reports that the company declined to comment on the Bloomberg figure, according to The420.in. The Texas attorney general has withheld correspondence from Cerner's attorneys that lists affected organizations, and it has asked its Open Records Division to rule on whether those records can be released.

Watch three things. The first is the Open Records ruling, which could identify the organizations behind the filings. The second is the HHS Office for Civil Rights portal, which still lists a placeholder of 501 individuals and is expected to update in the coming weeks. The third is whether Oracle issues a statement that matches the state totals. The federal number, when it arrives, will show whether the 19.9 million figure holds up.