Breach · · 3 min read
Oracle Health’s Cerner breach now counts almost 20 million people
A 2025 breach of old Cerner servers exposed names, Social Security numbers and medical records. New state filings put the total near 20 million, including about 3 million Texans.
A breach that started in January 2025 on old servers belonging to Cerner, the health-records company Oracle bought in 2022, turns out to be much larger than first known. Figures filed with U.S. state regulators now put it at almost 20 million people. If you were a patient at a U.S. hospital that used Cerner’s records system, here’s what to know.
What happened
According to the breach notice, someone first got into legacy Cerner servers as early as January 22, 2025, using stolen credentials. Oracle Health identified the breach in early 2025. The servers hadn’t yet been moved to Oracle’s cloud. The person behind it reportedly tried to extort the affected hospitals.
On October 8, 2026, The HIPAA Journal reported that, according to Bloomberg, information from the Texas Attorney General suggests almost 20 million people were affected. The figure hasn’t been independently verified, and Oracle Health hasn’t published a total. State filings that list numbers include:
- 2,992,244 people in Texas
- 1,978,661 in Oregon
- 283,903 in South Carolina
- 69,238 in Washington
The data taken includes names, Social Security numbers and health information such as diagnoses, medications, test results, medical images, medical record numbers and physician names. What was exposed varies by person and by hospital. The HIPAA Journal lists affected providers including AdventHealth, Baptist Health South Florida, ChristianaCare, LifeBridge Health, Munson Healthcare and OSF HealthCare, among others.
Oracle Health told its hospital clients that each one is responsible for deciding whether to report the breach and for notifying its own patients, which is part of why letters have trickled out over many months and why the federal breach portal still shows a placeholder number.
What this means for you
Medical records can’t be changed like a password. A Social Security number plus health details can be used for medical identity theft: someone getting care or filing insurance claims in your name. It can also make scams very convincing, because a caller can reference a real diagnosis or doctor.
What you can do
- Look for a letter from your hospital, not necessarily from Oracle. Enrol in any monitoring it offers using the instructions in the letter.
- Read your insurer’s “explanation of benefits” statements. Visits, prescriptions or equipment you don’t recognize are the main sign of medical identity theft.
- Freeze your credit at Equifax, Experian and TransUnion. It’s free in the U.S.
- Be careful with calls about your care or bills. Hang up and call the number on your insurance card or hospital statement.
How Frame helps
Frame keeps a catalog of known breaches. Add the ones you know you were part of to a verified email and Frame shows what each exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. We never collect or store the leaked records themselves.
Sources
- The HIPAA Journal, Almost 20 Million Individuals Affected by 2025 Data Breach at Oracle Health/Cerner, October 8, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.