Almost 20 Million Individuals Affected by Oracle Health/Cerner Data Breach
A hacking incident impacting Oracle Health earlier this year affected almost 20 million individuals, according to data obtained by Bloomberg. While it has long been clear that the hacking incident involved a significant amount of patient data, Oracle Health has not publicly disclosed how many individuals were affected by the incident, which involved data stored on legacy Cerner servers.
Cerner is a global health information technology company that builds electronic health record (EHR) systems that are used by more than 27,000 healthcare facilities globally. The company was acquired by Oracle in June 2022 in a $28.3 billion deal, and the health side of the business was rebranded as Oracle Health. The data impacted by the security incident was stored on two legacy Cerner servers that had yet to be uploaded to Oracle Cloud Infrastructure (OCI). A hacker gained access to the legacy servers as early as January 22, 2025, and exfiltrated data to a remote server. Oracle Health announced the data breach in March 2025 and said the hacker used stolen customer credentials to access the legacy servers between January 22, 2025, and April 1, 2025.
The data breach has been reported to state attorneys general as an incident at Cerner Corporation, rather than Oracle Health. The notices state that data compromised in the incident include names, Social Security numbers, and information associated with EHRs, including patient medical records, medical record numbers, physician names, diagnoses, medications, test results, medical images, and information related to care and treatment.
Only a few state attorneys general publicly disclose the number of state residents affected by healthcare data breaches. Based on available information, almost 3 million individuals in Texas, 1.9 million individuals in Oregon, and around 70,000 individuals in South Carolina have been affected; however, Bloomberg learned from the Texas Attorney General that almost 20 million individuals across the United States have been affected in total. The U.S. Department of Health and Human Services Office for Civil Rights has been notified, but the breach portal still lists the incident with the initial 501 total – a placeholder figure used at the time of reporting as the number of affected individuals had not been determined.
Should the incident be confirmed as affecting 20 million individuals, it would rank as one of the top 5 healthcare data breaches of all time. Oracle Health has been named in several class action lawsuits over the data breach that allege negligence for failing to adequately protect patient data. The litigation is ongoing, and Oracle Health/Cerner deny any wrongdoing.
