An extortion-driven intrusion into Oracle Health's legacy Cerner servers in early 2025 compromised the personal and medical data of about 19.9 million people. That figure comes from Cerner Corp.'s filing with the Texas Attorney General. The state's breach portal entry, published October 2, 2026, lists 2,992,244 affected Texans. Reporting on the filing puts the national total at 19,929,149 (Australian Directory News/Fox News). Bloomberg broke the national figure, and SecurityWeek, Fierce Healthcare, HIPAA Journal and Becker's carried it. One outlier exists: HealthExec says Bloomberg's coverage put the impact at 25 million. No other source repeats that number, and it conflicts with the roughly 20 million cited everywhere else. Oracle has not publicly confirmed any national total and declined to comment to Bloomberg. The HIPAA Journal also notes that the 20 million figure has not been independently verified.
What Happened
Cerner, the electronic health record (EHR) vendor that Oracle bought in June 2022 for about $28.3 billion, kept patient data on legacy servers that had not yet been migrated to Oracle Cloud. Oracle's customer notice, quoted by SecurityWeek, said the company became aware "on or around February 20, 2025" of unauthorized access to "an old legacy server not yet migrated to the Oracle Cloud." The sources do not agree on the timeline:
- Initial access: Every source agrees on January 22, 2025, or soon after. Oracle's notice says "sometime after" that date. The Oregon Attorney General lists the breach window as January 22 to April 1, 2025 (HIPAA Journal, SecurityWeek).
- Discovery: Oracle's customer notice says it became aware around February 20, 2025 (SecurityWeek). The formal breach notice says the intrusion was identified on March 7, 2025 (HIPAA Journal, Fierce Healthcare). Customer notifications are described as going out in "late February" (Fierce Healthcare) and in "March 2025" (SecurityWeek, Becker's).
- Delayed patient notice: Becker's reports that Oracle Health asked healthcare organizations to delay notification while it investigated. That helps explain why patient letters were still arriving in late 2026.
Who did it: Sources told BleepingComputer that the extortion attempts came from a lone actor using the name "Andrew." This actor has no claimed tie to any established ransomware or extortion group (SecurityWeek, HIPAA Journal). The actor demanded millions of dollars in cryptocurrency from affected hospitals and set up public websites about the breach to add pressure. HealthExec reports that the actor also contacted patients directly and demanded payment to delete their records. HealthExec also says Trustwave later found data on the dark web that criminals claimed came from Oracle. Separately, HealthExec reports that Bloomberg revealed in April that Oracle had suffered multiple related breaches. No other source here confirms that.
Affected providers: Oracle has not said how many Cerner clients were affected. Becker's lists 29 health systems that reported being affected, including Atrium Health, AdventHealth, Christus Health, OSF HealthCare, Methodist Le Bonheur, ChristianaCare, LifeBridge Health and Baptist Health South Florida. The HIPAA Journal estimates that as many as 80 hospitals may have been affected. Oracle Health and eight health systems also face a class action, which a federal judge allowed to proceed in June 2026 (Fierce Healthcare).
What Was Taken
The breach notices describe a broad mix of identity data and clinical data:
- Identity data: names, Social Security numbers, addresses and contact information
- Clinical data: diagnoses, care and treatment information, medications, test results, medical images, medical record numbers and physician names (HIPAA Journal, ICT&health)
The data exposed varies by patient and by provider (ICT&health).
Volume by source:
| Source | Affected individuals |
|---|---|
| Texas AG filing (national total, as reported) | ~19.9M (19,929,149) |
| HealthExec, citing Bloomberg | 25M (outlier, uncorroborated) |
| Texas | 2,992,244 |
| Oregon | 1,978,661 (1,970,332 + 8,329) |
| South Carolina | 283,903 |
| Washington | 69,238 |
| HHS OCR portal | 501 (placeholder, not yet updated) |
The HHS Office for Civil Rights portal still shows the 501 placeholder. The HIPAA Journal expects it to be updated within weeks. HealthExec, citing Bloomberg, notes that Oracle's health clients include the Department of Defense and Veterans Affairs. However, no source confirms that military or VA patient records were in this dataset.
Why It Matters
- This is one of the largest US healthcare breaches on record. At about 20 million people, it is the biggest of five vendor breaches that Becker's counted as each affecting more than 1 million people in 2026. Together those five total more than 30 million.
- Migration debt is attack surface. The attacker did not breach Oracle's cloud. They went through servers waiting to be migrated. Systems sitting between old and new infrastructure often get the least monitoring and the slowest credential cleanup.
- The risk sits with your vendor but lands on you. Dozens of health systems now carry notification costs, legal exposure and patient-trust damage from a breach of infrastructure they did not run. Oracle's request to delay notification also left providers stuck between the vendor's investigation and their own HIPAA deadlines.
- The disclosure gap is wide. Early state filings and notices made the breach look much smaller. The full scale came out about 19 months later, through a single state AG portal.
- Clinical data does not expire. Unlike payment cards, diagnoses and medical images cannot be reissued. That makes the data useful for long-term fraud, extortion and targeted social engineering. The actor's reported direct outreach to patients shows how this happens.
The Attack Technique
Oracle told customers the evidence pointed to stolen customer credentials being used to reach the legacy server. The attacker then copied the data to a remote server (SecurityWeek). Security firm CyPro, cited by ICT&health, says two Cerner servers were accessed. Oracle maintains that its cloud infrastructure was not affected. The Oregon AG's dates suggest the attacker may have had access for more than two months (January 22 to April 1, 2025), and possibly for weeks after Oracle first learned of the breach. The sources do not say how the credentials were stolen or whether multi-factor authentication was in place on the legacy systems.
After stealing the data, the actor followed a standard data-theft extortion playbook with no encryption involved. They sent ransom demands to hospitals, set up public shaming sites, and reportedly contacted patients directly.
What Organizations Should Do
- Inventory vendor-held legacy data. Ask every EHR and health IT vendor in writing which of your data still sits on pre-migration or legacy systems, how it is protected, and when it will be migrated or deleted.
- Enforce MFA and credential hygiene on every access path into vendor-hosted environments. That includes legacy and "temporary" systems. Rotate customer credentials used to reach vendor infrastructure, and treat any reuse of those credentials as a compromise signal.
- Write notification terms into vendor contracts. Business associate agreements should set firm timelines for incident disclosure and data sharing, so a vendor's investigation cannot quietly use up your HIPAA notification window.
- Watch for large outbound transfers from systems holding PHI. Copying data to a remote server is the core step in this attack. Alert on bulk outbound transfers from these systems, including on segments you consider to be in decommissioning.
- Prepare staff and patients for direct extortion. Brief call centers and patient-facing teams on ransom demands sent to individual patients. Publish guidance telling patients not to pay and where to report contact.
- Offer credit and identity monitoring, and check whether you are affected. Christus Health is offering two years of credit monitoring (ICT&health). Organizations using legacy Cerner should confirm with Oracle Health whether their data was included rather than waiting for the OCR portal to update.
Sources: Oracle Health data breach exposes nearly 20 million patients Austra... | Oracle Health Data Breach Tally Climbs to Nearly 20 Million | Oracle Health data breach in 2025 compromised data of 20M people: r... | Almost 20 Million Individuals Affected by 2025 Data Breach ... | 29 health systems affected by Oracle Health data breach | 5 healthcare vendor breaches each affecting more than 1 million people | Last year’s healthcare data breach at Oracle impacted 20M people: R... | Nearly 20 million affected by Oracle Health data breach ICT&health