Oracle Health’s 2025 data breach compromised personal information belonging to 19.9 million people, according to filings with the Texas attorney general obtained by Becker’s through a public records request. Bloomberg first reported the nearly 20 million figure Oct. 5.
The Texas attorney general’s data breach portal lists Cerner Corp. (now known as Oracle Health) as reporting nearly 3 million affected Texans. Exposed data included addresses, Social Security numbers and medical information. The entry was posted Oct. 2, and Cerner notified affected Texans by U.S. mail.
The count has grown tenfold since Cerner’s initial filing in July 2025, which listed nearly 2 million affected people, including 4,082 Texans. A supplemental filing in July 2026 raised the total to 18.6 million and the latest filing, submitted Sept. 30, added about 1.4 million more.
The filings say the breach began Jan. 22, 2025, was discovered Feb. 20, 2025, and ended April 1, 2025. They list credential compromise as the cause. Oracle alerted some healthcare customers in March 2025 that attackers had accessed older Cerner servers whose data had not yet been migrated to Oracle’s cloud, Bloomberg reported at the time. Oracle acquired Cerner in 2022 for $28.4 billion.
The attorney general’s office withheld correspondence from Cerner’s attorneys that responds to the office’s request for a list of affected organizations and the number of Texans affected at each. The office has asked its Open Records Division to rule on whether the records can be released.
At least 29 hospitals and health systems have reportedly been affected by the breach, and Oracle Health faces litigation over the incident.
Oracle’s healthcare customers include regional hospitals and clinics, the Defense Department and the Department of Veterans Affairs. A VA spokesperson said at the time of the March 2025 disclosure that the agency was not affected, according to Bloomberg. Cerner told the Texas attorney general it notified the FBI’s Nashville field office. The FBI investigated the attack and hackers’ attempts to extort ransom payments from medical organizations, Bloomberg reported in March 2025.
Oracle declined to comment to Bloomberg. Becker’s has reached out to Oracle and the Texas attorney general’s office for comment and will update this story if more information becomes available.
Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit
