Oracle Health Cerner breach: nearly 20 million people affected

We publish these pages from public notices and reporting so you can understand what was exposed. Everything here is already public. Always confirm with the organization named in your notice.

A report from the Texas Attorney General says a 2025 breach of Oracle Health's legacy Cerner servers exposed personal data of almost 20 million people, including about 3 million Texans. According to that report, the data includes Social Security numbers, home addresses and medical information. Because the notices come from individual hospitals and clinics rather than Oracle, many people may not realize their letter is about this incident.

What happened

Unauthorized access to legacy Cerner servers that had not yet been moved to Oracle Cloud began after January 22, 2025, and was identified in early 2025 (Reported, HIPAA Journal and Fierce Healthcare). Oracle did not give a total number of affected people at the time.

On October 2, 2026, the Texas Attorney General issued a report putting the total at almost 20 million people, including about 3 million Texans (Reported, Bloomberg Law). Oracle declined to comment on the figure.

Oracle told its healthcare provider customers that each one had to decide whether a reportable HIPAA breach had occurred and send its own notices (Reported). As a result, letters and state filings have arrived over many months, under the names of hospitals and clinics.

What data was involved

• Social Security numbers: Reported, from the Texas report
• Home addresses: Reported, from the Texas report
• Medical information, including treatment details: Reported
• Dates of birth, driver's license numbers and health insurance information: alleged in a consolidated class action complaint, not confirmed by Oracle

Names, addresses and Social Security numbers together are enough to attempt new accounts in your name. Medical and insurance details can be used to bill for care you never received.

What you can do now

1. Look for a letter from your hospital or clinic. Any notice that mentions Cerner, Oracle Health or a "third-party vendor" for electronic health records may relate to this incident. If you are unsure, call your provider's patient privacy office and ask whether your records were included.
2. Freeze your credit. Place a free freeze with Equifax, Experian and TransUnion so new credit cannot be opened in your name without your action.
3. Get an IRS Identity Protection PIN. It blocks fraudulent federal tax returns filed with your Social Security number.
4. Check your explanation of benefits statements. Review insurer statements for visits, tests or prescriptions you did not receive, and report anything unfamiliar to your insurer and provider.
5. Ask for your medical records if you see errors. Under HIPAA you can request a copy of your records and ask for corrections if fraudulent care was added.
6. Enroll in any monitoring offered. If your provider's letter includes credit monitoring, use the enrollment code in the letter.