Oracle Health data breach exposes nearly 20 million patients

When you visit a doctor or hospital, you expect your medical information to stay private. After all, your health records can reveal some of the most personal details about your life. Now, a massive cyberattack involving Oracle Health is raising serious questions about how well that information is protected.

Nearly 20 million people reportedly had their personal and medical information compromised in a cyberattack involving older Cerner systems. The attack dates back to early 2025, but new details about its reach are still emerging. For patients, the concern goes well beyond stolen passwords. Hackers may have obtained Social Security numbers, diagnoses and even medical images.

Breach Scale

The Oracle Health data breach appears to be much larger than earlier patient notifications suggested. According to figures reported in filings with the Texas Attorney General, the personal and medical information of approximately 19.9 million people was compromised in a cyberattack involving legacy Cerner systems. The Texas Attorney General's official data breach portal published Cerner's entry on October 2, 2026. It lists 2,992,244 affected Texas residents.

Oracle has not separately confirmed the nationwide total in a public statement. Still, the reported scale would place this incident among the largest healthcare data breaches in U.S. history. The attack involved older systems belonging to Cerner, an electronic health records company Oracle acquired in June 2022 for approximately $28.3 billion. The business now operates as Oracle Health.

Attack Details

The trouble began in early 2025. Oracle started notifying affected healthcare customers in March after discovering unauthorized access involving older Cerner systems. According to Oracle's customer communications, the company became aware of the incident around February 20, 2025. Investigators found evidence suggesting that an attacker used stolen customer credentials to access a legacy server sometime after January 22.

The attacker then copied information to a remote server. The server had not yet been migrated to Oracle Cloud. However, investigators have not publicly established that the server's age caused the breach. The precise way the attacker obtained the stolen credentials also remains unclear.

Ransom Demands

The attacker allegedly tried to turn the stolen information into a multimillion-dollar payday. According to earlier BleepingComputer reporting, an individual using the name "Andrew" contacted affected hospitals and demanded cryptocurrency payments. The attacker reportedly threatened to leak or sell stolen patient information unless the victims paid.

The individual also allegedly created public websites about the breach to increase pressure on healthcare organizations. At the time, researchers had not established a connection between the attacker and a known ransomware or extortion group. For hospitals, that creates a difficult situation. Even if an organization pays, there is no guarantee the criminal will delete the stolen records or refrain from selling copies.

Stolen Information

A sample breach notification filed with California regulators provides a closer look at the information potentially exposed. Depending on the patient, the compromised records may have included: full names and Social Security numbers, medical record numbers, doctors and diagnoses, prescription medications, medical test results, medical images, and treatment and care information.

The exact information exposed can vary from person to person. However, the combination of personal identifiers and medical details makes this incident particularly troubling. Unlike a stolen credit card, you cannot simply cancel your medical history and request a replacement. Your diagnoses, treatment records and past prescriptions can remain sensitive for years.

State Impact

State breach filings offer a clearer view of the attack's scale. The Texas attorney general's October 2, 2026, filing lists 2,992,244 affected residents in Texas alone. Other state notifications show how widely the incident spread. Oregon reported 1,978,661 affected residents, while South Carolina identified 283,903. Washington also reported 69,238 people whose information was compromised.

These figures represent portions of the overall incident and should not be added to the nationwide total of nearly 20 million. Meanwhile, filings with Oregon regulators identify January 22 through April 1, 2025, as the reported breach period, with February 20 listed as the discovery date.

Comparison and Protection

Unfortunately, healthcare organizations have become attractive targets for cybercriminals. Medical records contain information that can support identity theft and fraud long after an initial attack. One of the biggest examples came in 2024, when attackers targeted Change Healthcare, a subsidiary of UnitedHealth Group. That breach ultimately affected approximately 192.7 million people.

The Oracle Health incident appears smaller by comparison. Still, a reported 20 million affected individuals represents an enormous amount of sensitive information. To protect yourself, watch for breach notifications, freeze your credit if your Social Security number was exposed, and check your medical records and insurance statements for any suspicious activity.