The reported number of people affected by the 2025 intrusion into legacy Cerner servers has climbed to nearly 20 million. On October 2, 2026, the Texas Attorney General's data breach portal published an entry from Cerner Corporation listing 2,992,244 affected Texans. SecurityWeek reported on October 8 that Bloomberg, citing a Texas attorney general report, said the data of "nearly 20 million people was compromised." Fox News put the nationwide figure at 19,929,149 on October 18, describing it as "reported in connection with the filing."
Oracle Health, which owns Cerner, has not publicly confirmed the total. SecurityWeek said Oracle declined to comment to Bloomberg, and Fox News said Oracle Health did not respond to a request for comment before its deadline.
The incident itself is not new. It is the breach Oracle began disclosing to healthcare customers in March 2025, in which data on legacy Cerner servers that had not yet moved to Oracle Cloud was accessed. SecurityWeek describes the new tally as "far higher" than earlier filings and notifications suggested, and says that, if confirmed, it would make this one of the largest US healthcare breaches on record.
What the filings show
The Oregon Department of Justice lists two Cerner Corporation entries on its consumer data breach portal. Both give the same breach window, January 22 to April 1, 2025, and the same discovery date, February 20, 2025.
- First Oregon entry: reported July 25, 2025, notices sent July 25, 2025, 1,970,332 people affected.
- Second Oregon entry: reported July 6, 2026, notices sent June 22, 2026, 8,329 people affected.
The two Oregon entries total 1,978,661, the Oregon figure Fox News reported. Other state counts reported by Fox News and SecurityWeek:
- Texas: 2,992,244
- South Carolina: 283,903
- Washington: 69,238
Fox News cautions that these state figures are portions of the nationwide count and "should not be added to the nationwide total." The state filings are primary records, but each covers only that state's share of the incident, and the national figure has not appeared in an Oracle statement.
Timeline
- After January 22, 2025 (attacker): An unauthorized party accesses a legacy Cerner server. January 22 is the start of the breach window in Oregon DOJ records.
- February 20, 2025 (Cerner/Oracle): Cerner discovers the intrusion, per Oregon DOJ records. Fox News reports Oracle's customer communications give the same date for when it became aware.
- March 2025 (Oracle): Oracle begins notifying affected healthcare customers.
- April 1, 2025: End of the breach window in Oregon records.
- July 25, 2025 (Cerner): First filing with Oregon DOJ.
- June 22 and July 6, 2026 (Cerner): A second round of notices is sent and then reported to Oregon DOJ.
- October 2, 2026 (Texas AG): Cerner's Texas portal entry is published.
- By October 8, 2026 (Bloomberg): Bloomberg reports the nationwide total of nearly 20 million.
How the intrusion happened
Oracle's notice described the affected system as "an old legacy server not yet migrated to the Oracle Cloud," according to SecurityWeek. SecurityWeek reported that Oracle said the attacker likely used stolen customer credentials to access the server after January 22, 2025, and copied data to a remote server. How the credentials were stolen has not been disclosed. Fox News notes that investigators have not publicly established that the server's age caused the breach.
Oracle acquired Cerner in June 2022 for roughly $28.3 billion, according to SecurityWeek, and the business now operates as Oracle Health.
Sources told BleepingComputer, as cited by SecurityWeek and Fox News, that extortion attempts came from an individual using the name "Andrew," who contacted affected hospitals, demanded millions of dollars in cryptocurrency, threatened to leak or sell the data, and set up public websites about the breach. Those threats are the extortionist's claims. No link to an established ransomware or extortion group has been reported.
What data was exposed
A sample notice filed in California, cited by SecurityWeek, says the exposed information may include names, Social Security numbers, and patient medical record information such as diagnoses, medicines, test results and images. What was exposed varies by person and by which healthcare provider's data sat on the affected servers, so individuals should rely on the details in their own notice.
Counts have surfaced state by state, on each state's own portal and schedule. Oregon's second entry was reported nearly a year after the first.
What It Means for Defenders
As reported, the intrusion relied on stolen customer credentials rather than a software flaw, so there is no patch to apply.
- Hold pre-migration systems to current controls. List every legacy host that still stores regulated data while awaiting migration or retirement, and confirm it has the same MFA, logging and access review as its replacement.
- Require phishing-resistant MFA on vendor-hosted access. If portals and hosted systems holding your patients' data accept passwords alone, raise it with the vendor in writing and through contract terms.
- Rotate credentials tied to legacy Cerner environments. Organizations that used legacy Cerner services should rotate the associated service and user credentials and confirm with Oracle Health which accounts were in scope.
- Confirm your own notification duties. Covered entities whose patient data sat on the affected servers should work with counsel and Oracle Health to determine their obligations under HIPAA and state law and whether patients have been notified.
- Brief front-line staff on follow-on fraud. Exposed SSNs and medical record details support medical identity theft and convincing phishing; call centers and patient-facing staff should know what the leaked details look like in a social-engineering attempt.
Individuals who receive a notice can freeze their credit with Equifax, Experian and TransUnion, accept any monitoring offered, and review insurer explanation-of-benefits statements for care they did not receive.
