What happened

The Texas Attorney General disclosed on October 2, 2026, that Oracle reported the theft of personal information belonging to nearly 20 million people, including roughly 3 million Texans, in the 2025 breach of its healthcare unit. Texas law requires any organization to file a report with the Attorney General when a breach affects 250 or more state residents, and the office maintains a public listing of those reports. The figure is far higher than the counts previously filed with individual states, which stood at a few thousand residents each when Cerner began reporting to attorneys general in 2025. Stolen data includes Social Security numbers, addresses, and medical information.

 

Going deeper

Oracle Health detected the breach of legacy Cerner data migration servers on February 20, 2025, and determined that an attacker had used compromised customer credentials to reach them sometime after January 22, BleepingComputer reported after reviewing notices sent to affected customers. Those servers held data that had not yet been moved to Oracle Cloud as part of a migration, and the attacker copied information from them to a remote server. No software flaw was involved. Oracle Health, formerly Cerner, supplies electronic health record and business operations systems to hospitals and healthcare organizations, which is why one intrusion reached records belonging to patients of many separate providers.

 

What was said

"We are writing to inform you that, on or around February 20, 2025, we became aware of a cybersecurity event involving unauthorized access to some amount of your Cerner data that was on an old legacy server not yet migrated to the Oracle Cloud," Oracle Health told affected customers in a notice seen by BleepingComputer. The letter was signed by Seema Verma, Executive Vice President and General Manager of Oracle Health. Oracle has said separately that Oracle Cloud Infrastructure and customer cloud environments were not breached.

 

In the know

Hospitals holding the stolen data were approached directly for payment. Sources told BleepingComputer that affected organizations were being extorted by a threat actor using the name Andrew, who claimed no affiliation with any known ransomware or extortion group, demanded millions in cryptocurrency, and built public websites about the breach to increase pressure on the hospitals to pay, according to its reporting. SC World covered the same activity, noting that the demands were made by an individual rather than an affiliate of an established group. Breach reports from Cerner continued arriving at state attorneys general through the following year, BankInfoSecurity reported, with filings in California, South Carolina, and Texas listing a few thousand residents each at that stage.

 

The big picture

Notification runs through the provider rather than the vendor in cases like this. Oracle supplied affected healthcare organizations with lists of their own patients, leaving each covered entity to determine whether the incident was reportable and to issue notices, which is how the Breach Notification Rule allocates the duty when a business associate is involved. Research on this pattern found that vendor-involved breaches run substantially larger than provider-only breaches once they pass 100,000 affected individuals, with predicted figures around 671,000 against 423,000, in a study published in Health and Technology analyzing 831 provider-reported incidents. The author calls the shape hub-and-spoke, with a figure near 20 million at the far end. Provider organizations should confirm which of their records sat in migration environments during any vendor transition, since data held temporarily outside a production system is easy to leave out of an inventory.

 

FAQs

Why would data sit on legacy servers during a migration?

Moving an electronic health record system to a new platform takes months, and the old environment stays live while records are transferred and validated. Those staging systems hold production data while often falling outside the monitoring and patching applied to the primary environment.

 

Who notifies patients when a vendor is breached?

The covered entity does. A business associate must report the breach to its client, and the client remains responsible for notifying affected individuals, HHS, and, in larger incidents, the media. The vendor can assist with identifying individuals and preparing notices without taking on the obligation.

 

Why do reported figures rise so long after an incident?

Determining who was affected requires matching records to individuals, which runs separately for every client organization involved. Counts filed with states reflect only residents of that state, so a national total emerges slowly and can change as reviews are completed.

 

What can patients do when Social Security numbers and medical records are both exposed?

Place a credit freeze with the three bureaus at no cost for the identity element, and review explanation of benefits statements for services never received for the medical element. Neither control substitutes for the other.

 

How should a provider assess exposure during a vendor migration?

Ask which environments hold its data at each stage, who has credentials to them, how long data remains in staging, and what monitoring covers those systems. Migration environments are frequently absent from the asset inventory a risk analysis is built on.