Almost 20 million Americans had their personal and medical information stolen in a cyberattack on legacy Cerner systems now owned by Oracle Health, according to figures reported in filings with the Texas Attorney General. The breach dates back to early 2025, but the full scope has only become clear in filings published this October.
The Texas Attorney General’s data breach portal published Cerner’s entry on October 2, 2026, listing 2,992,244 affected Texas residents out of a reported nationwide total of 19,929,149 people. Oracle has not separately confirmed that nationwide figure in a public statement.
Other states hit by the same breach include Oregon, with 1,978,661 affected residents; South Carolina, with 283,903; and Washington, with 69,238. These state totals are portions of the overall incident and should not be added together.
How It Happened
Cerner is an electronic health records company Oracle bought in June 2022 for roughly $28.3 billion, now operating as Oracle Health. Oracle began notifying affected healthcare customers in March 2025 after discovering unauthorized access to older Cerner systems. The company says it became aware of the incident around February 20, 2025. Investigators found evidence that an attacker used stolen customer credentials to access a legacy server sometime after January 22, then copied patient information to a remote server. That server had not yet been migrated to Oracle Cloud, though investigators have not publicly established that its age caused the breach. How the attacker got the credentials in the first place remains unclear.
Oregon filings identify the breach period as January 22 through April 1, 2025, with February 20 listed as the discovery date.
Extortion Attempt
According to earlier BleepingComputer reporting, an individual using the name
