A cyberattack on Oracle Health’s older Cerner systems compromised personal and medical information for nearly 20 million people, with stolen credentials used to copy data and extortion demands following.
Unauthorized access to a legacy Cerner server allowed an attacker to copy patient information to a remote system, and state filings now put the nationwide total near 19.9 million people.
Fox News tech reporting describes the incident as centered on older systems not yet moved to Oracle Cloud, with trouble dating to early 2025 and formal notice to healthcare customers beginning in March after the company learned of the access around February 20.
Patients across multiple states now face the practical fallout: names, Social Security numbers, medical record numbers, diagnoses, prescriptions, test results, images, and treatment details may have been exposed, depending on the individual file.
That is not a minor paperwork glitch. It is a direct hit on people who trusted hospitals and clinics to keep their most private records locked down.
Investigators found evidence that the attacker used stolen customer credentials sometime after January 22, 2025, to reach a legacy server and move information off-site.
Filings with Oregon regulators list the breach window as January 22 through April 1, 2025, and list the discovery date as February 20.
Oracle Health began notifying affected healthcare customers in March. The precise way the credentials were stolen has not been publicly pinned down, and investigators have not established that the server’s age alone caused the breach.
The machine in question had not yet been migrated to Oracle Cloud. After Oracle bought Cerner in June 2022 for about $28.3 billion, the business continued under the Oracle Health name while older systems remained in use.
The Texas Attorney General’s data breach portal published Cerner’s entry on October 2, 2026, listing 2,992,244 affected Texas residents and a nationwide figure of 19,929,149 people connected to the filing.
Oregon reported 1,978,661 affected residents. South Carolina identified 283,903. Washington reported 69,238 people whose information was compromised.
A sample breach notice filed with California regulators described the categories of data that may have been involved: full names and Social Security numbers, medical record numbers, doctors and diagnoses, prescription medications, medical test results, medical images, and treatment and care information.
Oracle has not separately confirmed the nationwide total in a public statement in the available reporting, and the author of the Fox News account said outreach to Oracle Health drew no reply before deadline.
Earlier reporting cited in the account said an individual using the name “Andrew” contacted affected hospitals, demanded cryptocurrency payments, and threatened to leak or sell stolen patient information.
That contact also allegedly built public websites about the breach to raise pressure. Researchers had not tied “Andrew” to a known ransomware or extortion group at the time of the reporting.
No arrests, charges, or court orders are described in the account. What remains is the open risk to patients: identity theft, medical fraud, and follow-on scams that prey on people whose records are already in the wrong hands.
The attack activity sits in early 2025. Customer notifications started in March. Oregon’s regulator filings fixed the window and discovery date. The Texas portal entry making the Cerner numbers public landed on October 2, 2026.
That gap matters. Families living with the consequences of a health-records breach do not get those months back. Credit monitoring and fraud alerts are downstream chores that fall on the patient, not on the vendor that held the data.
For context on sheer size, the 2024 Change Healthcare breach tied to UnitedHealth Group ultimately affected about 192.7 million people. The Oracle Health matter is smaller on raw headcount and still large enough to put millions of Americans on notice.
When medical and identity data leave a hospital system, the ordinary defenses become necessary homework. Free credit freezes remain available through Equifax, Experian, and TransUnion. Watching explanation-of-benefits statements and bank activity for unfamiliar claims is basic self-defense after a breach of this type.
Hospital names beyond the state aggregates are not listed in the reporting. Specific facility-by-facility totals are not broken out. Patients who received notice letters from their providers are the ones with the clearest signal that their files were in scope.
The core failure is straightforward. A major health-IT platform still running legacy Cerner infrastructure saw customer credentials used against a server that had not moved to the modern cloud environment. Data left the building. Extortion threats followed. State portals and regulator filings, not a swift company-wide public tally, are what made the near-20-million figure visible.
Americans who show up for care should not have to wonder whether their diagnoses, Social Security numbers, and treatment histories are sitting on a remote server because an older system stayed online too long. Accountability on health data security is not optional when nearly 20 million records are on the line.
