Texas Filing Puts Oracle Health's Legacy Cerner Breach at 19.9 Million People

A hacker got into two old Cerner servers in early 2025. Nearly two years of fallout later, the number of people affected is far larger than the early notices suggested.

The Texas attorney general's data breach portal published an entry for Cerner Corp. on Oct. 2, 2026. It lists 2,992,244 affected Texas residents. The nationwide figure tied to the filing is 19,929,149 people.

Oracle has not separately confirmed that national total in a public statement. Oracle Health has also not said how many Cerner clients were affected.

What was taken

The breach notice says an unauthorized person first got into legacy Cerner servers as early as Jan. 22, 2025. Oracle Health identified the breach on March 7, 2025. The Oregon attorney general lists the breach window as Jan. 22 to April 1, 2025.

Oracle's customer communications put the company's awareness around Feb. 20, 2025. That is earlier than the March 7 date in the breach notice. Oracle has not explained the gap.

The exposed data includes names, addresses and Social Security numbers. It also includes medical record numbers, physician names, diagnoses, treatment information, medications, test results and medical images.

What was taken varies by person and by provider. Not every patient lost every category.

How it happened

Oracle told customers the attacker used compromised customer credentials to reach two legacy Cerner servers. The data on them had not yet been migrated to Oracle Cloud. The attacker then copied patient data to a remote server.

The UK cybersecurity firm CyPro described the same sequence. How the attacker obtained the credentials has not been made public. Investigators have also not publicly established that the servers' age caused the breach.

This was not a ransomware gang. Reporting in March 2025 pointed to a single threat actor who contacted hospitals demanding millions in cryptocurrency, according to BleepingComputer. The hacker used the name "Andrew." The demand was to keep the stolen data from being published.

The state-by-state count

Only a handful of states publish per-incident numbers. The ones that do show:

• Texas: 2,992,244
• Oregon: 1,978,661
• South Carolina: 283,903
• Washington: 69,238

The federal picture is behind. The HHS Office for Civil Rights breach portal still lists the incident with a placeholder total of 501 individuals. The HIPAA Journal, which compiled the state figures, says Texas received the updated total on Oct. 2. It expects the federal portal to be corrected in the next few weeks.

The list of affected providers is also incomplete. Neither Oracle nor the Texas attorney general has named every hospital and clinic involved. CyPro counts at least 29 hospitals and health systems that have said they were affected. The HIPAA Journal says as many as 80 hospitals may have been hit.

Christus Health in Texas and Tri-City Medical Center in California are among those that have disclosed. Christus said affected patients will get letters and two years of complimentary credit monitoring and identity protection.

Oracle's healthcare customers include hospitals and clinics in Texas and other states, as well as the Department of Defense and the Department of Veterans Affairs. No source has said which, if any, federal patients were in the stolen data.

Who owns the risk

Oracle bought Cerner in June 2022 in a deal reported at roughly $28 billion. Its position is that its own cloud infrastructure was not affected and that the stolen data sat on older servers that had not been migrated.

John Strand, owner of Black Hills Information Security, rejects that framing. "I don't like the fact that Oracle is kind of hand-waving this away by saying these were legacy systems that hadn't been migrated to their secure cloud services yet," he told the HIPAA Journal. "They're still responsible." Strand said security due diligence has to be part of any acquisition.

Rob McBride, a founding partner at CyPro, wrote that the case shows how older infrastructure can stay a material source of third-party risk during a cloud migration. Even with Oracle's cloud unaffected, he noted, data on two legacy servers was enough to expose information on potentially millions of patients.

Legal exposure

Oracle faces a consolidated federal class action in the U.S. District Court for the Western District of Missouri. The litigation traces to April 2025, when two women filed a class action over the breach. Twenty-nine separate class actions filed across 13 states were consolidated into a single master case. In June, a federal judge ruled that the lawsuit against Oracle Health and eight health systems can move forward. No ruling has found Oracle liable.

For patients, the practical advice is routine but sound. Cliff Steinhauer of the National Cybersecurity Alliance says stolen names, addresses and health details make scam calls more believable. His guidance: if someone claims to be from an insurer or provider and asks for sensitive information or payment, hang up and call back on a number you know, such as the one on your insurance card.

Affected people should also check credit reports, bank accounts and healthcare statements for activity they don't recognize, and use any monitoring offered.

Two things are still open. One is when the HHS Office for Civil Rights replaces its 501-person placeholder with the real total. The other is whether Oracle publicly confirms the 19.9 million figure and names the providers whose patients were exposed.