The 2025 data breach at Oracle Health, the company formerly known as Cerner, affected nearly 20 million people, according to a report filed with the Texas attorney general and cited by Bloomberg, SecurityWeek reported Thursday. The total is far higher than the counts that emerged from earlier notifications to patients and regulators.

What Happened

The Texas filing lists 2,992,244 affected residents of that state. Separate notices filed with regulators put the number at about 283,000 in South Carolina and about 69,000 in Washington. Notifications have also been filed in Oregon and California.

According to the notices, the exposed information includes names, Social Security numbers and details from patient medical records, such as medical record numbers, treating doctors, diagnoses, medications, test results, images and records of care and treatment.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

The intruder used stolen customer credentials to get into the systems on Jan. 22, 2025, and access continued until April 1, 2025. Oracle learned of the activity on Feb. 20, 2025, and began notifying customers in March of that year. Oracle has said the attack hit an old legacy Cerner server that had not yet been moved to Oracle Cloud.

The attacker, who went by the name "Andrew," was not tied to any known ransomware gang, SecurityWeek said. The person demanded millions of dollars in cryptocurrency and set up public websites about the breach to pressure victims into paying.

Oracle declined to comment to Bloomberg on the 20 million figure and has not confirmed it publicly.

Why It Matters

If confirmed, the incident would rank among the largest healthcare data breaches in U.S. history. Only the 2024 ransomware attack on Change Healthcare, which affected 192.7 million people, would clearly be bigger.

The combination of Social Security numbers with diagnoses, prescriptions and test results gives criminals material for identity theft, insurance fraud and targeted extortion, and unlike a payment card, medical history cannot be reissued.

The case also shows how breach totals in health care often surface piecemeal. Oracle Health supplies electronic health record systems to hospitals and clinics, which hold the patient relationships. As a result, the scale of the incident has come together largely from state filings and hospital notices rather than from a single company disclosure.

Context

Oracle bought Cerner in 2022 and has been moving its customers onto Oracle Cloud Infrastructure. The breached servers belonged to the older Cerner environment that had not yet been migrated.

The intrusion also shows the lasting risk of stolen credentials on systems that are slated for retirement. The attacker did not need a software exploit; valid customer logins were enough to reach patient data that stayed on legacy hardware during the transition.

What to Watch

Oracle has not confirmed the nationwide total, so further state filings could change it. A listing on the U.S. Department of Health and Human Services breach portal, where incidents affecting 500 or more people must be reported, would give an official federal count. Regulators and affected hospitals may also press Oracle for more detail on how long data sat on unmigrated servers.