The 2025 intrusion into Oracle Health's legacy Cerner servers affected nearly 20 million people. That figure comes from a filing by the Texas attorney general, first reported by Bloomberg on October 5, 2026. It is the first public count, more than 18 months after Oracle began privately telling hospital customers about the incident in March 2025. Attackers used compromised customer credentials to get into old Cerner servers that had not yet been moved to Oracle Cloud. They then copied patient records to a remote server. The stolen data includes Social Security numbers, home addresses, diagnoses, medications and test results. About 3 million of the people affected live in Texas. Oracle declined to comment on the new figure, and the Texas AG's office did not respond to press inquiries.
None of the sources available for this brief is a primary document. We have not seen the Texas AG filing or Oracle's customer notice directly. Both are known only through press and secondary reporting, so the figures below are attributed to whoever reported them.
What Happened
Oracle bought Cerner for about $28.3 billion in 2022, renamed it Oracle Health and began moving Cerner workloads to Oracle Cloud. Some customer data stayed on older Cerner servers that had not been migrated. Those servers were the target.
The timeline, as pieced together from the sources:
- January 22, 2025 (at the latest): Unauthorized access began. Hospital notices, including Huntsville Hospital Health System's, say access started "at least as early as" this date. Oracle's customer notice said the intrusion happened "sometime after" January 22.
- On or around February 20, 2025: Oracle Health's customer notice, as reported by BleepingComputer and quoted by Settlement Insight, says the company became aware of "unauthorized access to some amount of your Cerner data that was on an old legacy server not yet migrated to the Oracle Cloud."
- March 2025: Oracle notified some Oracle Health customers. BleepingComputer reported on March 28, 2025 that Oracle had not disclosed the incident publicly and had not answered questions sent since March 4. Bloomberg reported at the time that the FBI was investigating.
- August 12, 2025: Huntsville Hospital says Cerner told it and other clients that their patients' data was involved.
- Through mid-2026: Hospitals kept mailing notification letters in their own names. Settlement Insight says some letters were still going out in June 2026. Becker's reports that Oracle Health asked healthcare organizations to delay notification while the investigation ran, and Huntsville Hospital says law enforcement directed the delay.
- October 5, 2026: The Texas AG filing puts the total at nearly 20 million.
A conflict in the record on the year. Briefs.co's summary, and Rankiteo's write-up based on it, describe a "2024 breach" and an intrusion "after January 22, 2024." Briefs.co's own body text says the data was stolen "last year," which means 2025. Becker's, Startup Fortune, Settlement Insight and the hospital notices all put the intrusion in early 2025. We treat 2025 as correct and the 2024 references as an error in that one secondary chain.
Scope of affected providers. Becker's Hospital Review lists 29 health systems that have reportedly been affected. They include Atrium Health, AdventHealth, Christus Health, OSF HealthCare, Baptist Health South Florida, Methodist Le Bonheur Healthcare, ChristianaCare, Albany Med Health System, Huntsville Hospital Health System and Sharp Tri-City Medical Center. Settlement Insight reports that more than 40 hospital and health-system entities are parties to one federal case in Missouri. Becker's list should therefore be read as a floor, not a complete count. Oracle Health's customers also include the Department of Defense and the Department of Veterans Affairs. A VA spokesperson said in March 2025 that the VA was not affected. How other federal customers were affected has not been made public.
What Was Taken
Reports on the number of people affected have changed over time:
- Nearly 20 million: Texas AG filing, as reported by Bloomberg, Briefs.co and Startup Fortune. This is the most authoritative figure available.
- About 3 million Texas residents within that total, from the same filing.
- More than 6 million: alleged earlier in a class action filed in the Western District of Texas, according to Startup Fortune. The current figure is more than three times that.
- Over 100,000 patients: at Huntsville Hospital alone, according to a law-firm analysis (EOL Law). The hospital's own public notice gives no Huntsville-specific count, so this figure is unverified.
Data types named across hospital notices and press reports:
- Patient names and home addresses
- Social Security numbers
- Medical record numbers
- Treating physicians
- Diagnoses, medications and prescriptions
- Test results and medical images
- Care and treatment details
Christus Health, Tri-City Medical Center and Huntsville Hospital all say the data exposed differs from patient to patient. Not every field was taken for every person.
Medical identity data like this lasts a long time. A Social Security number combined with a diagnosis history can be used for insurance fraud, fraudulent prescriptions and targeted extortion for years, and unlike a payment card it cannot be reissued.
Why It Matters
Migration debt is attack surface. The attackers did not break into Oracle's current cloud infrastructure. They went after the servers left behind during a multi-year migration. Data on legacy systems awaiting decommissioning tends to get less monitoring and weaker credential rules, and it often sits outside the new platform's security model. Any organisation in the middle of a large platform migration has some version of this gap.
Vendor breaches reach patients through the hospital. Patients got letters from their hospital about a breach at "our EHR vendor, Cerner," even though, as Huntsville Hospital stresses, no hospital-run system was breached. Hospitals were left carrying the notification work, the reputational damage and the legal exposure for an incident on infrastructure they did not control.
Delayed disclosure is now being litigated. Oracle took more than 18 months to give a public victim count. Hospitals were asked to hold off on notification. A Western District of Texas class action alleges Oracle missed the 60-day disclosure window under Texas law. Settlement Insight reports that as of September 30, 2026 there is no settlement and no claim form. Third-party risk teams should expect regulators to look more closely at contract terms that let a vendor control the notification timeline.
Possible extortion. Bloomberg reported in March 2025, as relayed by Briefs.co and Rankiteo, that the FBI was looking into allegations that the attackers tried to extort medical providers. No group has been publicly and credibly linked to the intrusion, and none of the sources confirms that any ransom was paid.
The Attack Technique
The reported intrusion chain has three steps:
- Initial access through valid accounts. According to Oracle's customer notice as reported by BleepingComputer, the attacker used compromised customer credentials. Oracle Health's customers are hospitals and clinics, so these were most likely provider-side accounts that could reach the Cerner environment. How the credentials were stolen (phishing, infostealer malware, reuse from another breach) has not been disclosed.
- Targeting the unmigrated environment. The access led to a legacy Cerner server still holding patient data before its move to Oracle Cloud.
- Exfiltration to attacker-controlled infrastructure. Records were copied to a remote server. No reporting mentions ransomware deployment or encryption.
Under MITRE ATT&CK this maps most closely to T1078 (Valid Accounts) for initial access and T1041/T1048 (Exfiltration Over C2 or Alternative Protocol) for data theft. Oracle has not published indicators of compromise, a dwell-time analysis or the attacker's lateral movement. The gap between first access (by January 22) and detection (around February 20) suggests about four weeks of undetected access.
What Organizations Should Do
- Inventory and harden legacy data during migrations. Treat systems waiting for decommissioning as production systems. Enforce MFA, current logging and EDR on them until they are switched off, and make data deletion on legacy hosts a tracked milestone with an owner.
- Require phishing-resistant MFA on all vendor-facing access. Customer accounts that reach a vendor-hosted EHR environment should not work with a password alone. Ask your EHR and other clinical SaaS vendors to show that MFA applies to every customer access path, including old ones.
- Monitor for bulk data movement. Alert on unusual query volume, large exports and outbound transfers from clinical data stores. Four weeks of undetected access points to a detection gap that egress and data-access baselines can close.
- Hunt for stolen credentials. Watch infostealer logs and credential-leak feeds for your domains and vendor-portal logins. Rotate any exposed credentials immediately and review where shared or service accounts can reach vendor systems.
- Rewrite vendor breach clauses. Business associate agreements and EHR contracts should set fixed timelines for notifying you, require per-customer record counts, and say who controls patient notification. Do not let a vendor's timeline become your regulatory exposure.
- Prepare patient-facing response for vendor incidents. Plan for a breach at a third party that you will have to notify patients about. Pre-arrange credit and medical identity monitoring, call-centre capacity and plain-language explanations of where the breach happened.
Sources: Oracle Health Breach From 2025 Now Confirmed to Have Hit 20 Million... | 29 health systems affected by Oracle Health data breach - Becker's... | beckershospitalreview.com | 520 Days, Over 100,000 Patients: What the Huntsville Hospital Data... | Oracle Health Data Breach: Cerner Hack, Hospital List, Lawsuit Set... | Physician cybersecurity - American Medical Association | Tri-City Medical Center and Oracle: Oracle healthcare breach expose... | Oracle healthcare breach exposed 20M records