Vulnerabilities · Privacy
Oracle Health data breach may have exposed nearly 20 million patient records
A cyberattack on Oracle Health’s legacy Cerner systems may have compromised the personal and medical data of almost 20 million people, according to a report citing state filings.
Ross Grant3 min read
The short version
Nearly 20 million people may have had their personal and medical information exposed in a cyberattack on Oracle Health’s old Cerner systems. The attacker used stolen passwords to access sensitive data, including names, Social Security numbers, and medical records. Oracle has not confirmed the total number affected. If you are a patient, watch for notifications and monitor your accounts for unusual activity.
By the numbers
- 19.9 millionpossible number of people affected, according to SecurityWeekSecurityWeek
- 2,992,244Texans affected, according to Texas attorney generalSecurityWeek
- 283,000South Carolina residents affectedSecurityWeek
- 69,000Washington residents affectedSecurityWeek
- $28.3 billionvalue of Cerner acquisition by Oracle in 2022SecurityWeek
What happened?
A cyberattack on Oracle Health’s legacy Cerner systems early in 2025 may have exposed the personal and medical data of nearly 20 million people. The breach was discovered in February 2025 and involved unauthorised access using stolen credentials. Oracle began notifying healthcare customers in March 2025. The company has not confirmed the total number affected.
What we know about the Oracle Health breach
A cyberattack on Oracle Health’s legacy Cerner systems may have exposed the personal and medical information of nearly 20 million people. This number comes from a report by SecurityWeek, which cites filings with US state regulators and a report from the Texas attorney general. Oracle has not confirmed the total number of people affected and declined to comment to Bloomberg, which first reported the scale of the breach. Only SecurityWeek has reported these details so far, and there is no public statement from Oracle or a government agency.
Cerner, a major electronic health record (EHR) vendor, was acquired by Oracle in June 2022 and now operates as Oracle Health. The breach affected old Cerner servers that had not yet been moved to Oracle’s cloud systems. Oracle began alerting healthcare customers in March 2025, saying it became aware of the incident on or around 20 February 2025. The breach itself is believed to have started after 22 January 2025 and continued until at least 1 April 2025, according to filings with Oregon regulators.
What data was exposed
According to a sample notification letter filed with California regulators, the information accessed may include names, Social Security numbers, and details from patient medical records. This could cover medical record numbers, doctors, diagnoses, medicines, test results, images, and care and treatment details. This type of data is highly sensitive and could be misused for identity theft, fraud, or medical scams.
How the attack happened
Oracle told customers that the attacker used stolen customer credentials (usernames and passwords) to access a legacy server. The attacker then copied data to a remote server. There is no mention of malware or ransomware being used in the attack. Sources told BleepingComputer that the extortion attempts came from an individual using the name ‘Andrew’, who was not linked to any known ransomware or extortion group. The attacker demanded millions of dollars in cryptocurrency and set up public websites to pressure victims.
Who is affected and what should you do?
The Texas attorney general’s data breach portal lists nearly 3 million affected Texans. South Carolina and Washington filings list 283,000 and 69,000 residents, respectively. The total number of people affected across the US may be close to 20 million, but this figure is not confirmed by Oracle. If you are a patient whose records were managed by Cerner or Oracle Health, you may be at risk. Watch for notifications from your healthcare provider and monitor your accounts for suspicious activity. Consider placing a fraud alert or credit freeze if your Social Security number was involved.
How this compares to other healthcare breaches
If confirmed, this would be one of the largest healthcare data breaches in US history. Only a few incidents, such as the 2024 Change Healthcare ransomware attack (which affected 192.7 million people), have been larger. Healthcare data breaches are especially serious because of the sensitivity of the information involved and the potential for long-term harm to individuals.
What happens next
Because Oracle has not made a public statement and only one outlet has reported the full scale, many details remain unclear. Regulators may investigate, and affected individuals could see more notifications in the coming months. Under US law, most states require companies to notify residents if their personal data has been breached. Regulators can also impose fines, and class action lawsuits are possible if negligence is found.
Practical advice
- If you receive a breach notification, follow the instructions carefully.
- Monitor your credit and health insurance statements for suspicious activity.
- Be wary of phishing emails or calls pretending to be from your healthcare provider.
- Use strong, unique passwords for all accounts, and enable multi-factor authentication where possible.
For now, the full scope and impact of the Oracle Health breach are not confirmed. We will update this story as more information becomes available.
Claimed vs confirmed
- Unconfirmed
Nearly 20 million people were affected by the Oracle Health breach.
SecurityWeek reports this figure based on state filings, but Oracle has not confirmed it.
- Unconfirmed
The attacker was an individual known as 'Andrew', not linked to any group.
Sources told BleepingComputer the extortionist acted alone, but this is not officially confirmed.
The impact
- Money
- If confirmed, Oracle could face regulatory fines under US state laws. Fines for healthcare data breaches can be significant, and class action lawsuits are possible if negligence is found.
- Reputation
- Oracle Health’s reputation may suffer, especially among healthcare providers and patients. The breach highlights risks in legacy systems and may affect trust in Oracle’s handling of sensitive data.
- Customers
- Patients whose data was managed by Cerner or Oracle Health could be at risk of identity theft or fraud. They should watch for breach notifications and monitor their accounts for suspicious activity.
Why it matters
This breach could affect millions of patients whose data was managed by Cerner or Oracle Health. Medical and personal information is highly sensitive and can be used for identity theft or fraud. The incident highlights the risks of legacy systems and the importance of strong credential security.
How does it work?
The attacker used stolen customer credentials to access a legacy Cerner server and copied sensitive data to a remote server. There is no evidence of malware or ransomware. The attacker demanded a ransom in cryptocurrency and tried to pressure victims by publicising the breach.
Key points
- Nearly 20 million people may be affected by the Oracle Health breach, but this is not confirmed.
- The attacker used stolen credentials to access sensitive medical and personal data.
- Oracle has not made a public statement on the total number affected.
- Healthcare data breaches can have serious, long-term impacts for individuals.
- Legacy systems are a common target for attackers due to weaker security.
Sources
SecurityWeek
Reference
