For more than a year, nobody outside Oracle knew how big the 2025 hack of its health unit really was. Now there is a number: nearly 20 million people.
The figure comes from a notice on the Texas attorney general’s data breach portal. Bloomberg reported on it, and trade outlets including Becker’s Hospital Review and Techzine followed. Techzine notes that it is the first time a specific total has been made public.
What the filing says
According to Becker’s, the breach hit legacy servers from Cerner, which Oracle bought and now runs as Oracle Health. The Texas portal lists almost 3 million affected Texans. Exposed data included addresses, Social Security numbers and medical information.
The security firm Cypro, summarising the disclosure, says the filing was dated 2 October 2026. It describes the attacker as having used compromised customer credentials to reach the old Cerner systems.
Earlier figures were far lower. A claims-tracking site had put the total at about 1.9 million, and an update to the Texas filing in July 2026 raised the Texas count to roughly 2.66 million. The jump to nearly 20 million nationwide is a large revision.
How it unfolded
The HIPAA Journal reports that state filings place the intrusion between 22 January and 1 April 2025. Oracle Health says it became aware of the breach around 7 March 2025. The affected servers had not yet been moved to Oracle Cloud, according to the same coverage.
Notification was slow for some providers. The HIPAA Journal says that two hospitals, OSF Saint Clare Medical Center and NKC Health, only received lists of affected patients in November, about 11 months after the intrusion.
The scale of the customer base is considerable. Oracle Health serves large hospitals, small clinics and government bodies, including the Defense Department and the Department of Veterans Affairs, according to CPO Magazine. Becker’s says at least 29 hospitals and health systems have reportedly been affected. Other outlets cite up to 80 providers, so the count of affected organisations is not settled.
The HIPAA Guide reports that notification letters are now being mailed to patients. Oracle Health has not itself published the total, that site notes. Several providers, including Lake Regional Health System in Missouri and Aultman Health System in Ohio, have confirmed they were affected and offered free credit monitoring.
Lawsuits have followed. Becker’s says Oracle Health faces litigation over the incident.
What the data could be used for
Security analysts at Rescana say no misuse of the stolen data has been reported so far. They also warn that the information carries a long-term risk of identity theft and fraud. Social Security numbers and medical histories do not expire the way a card number does.
Rescana describes the attacker as a lone hacker, not tied to any known ransomware group. That description comes from one analyst firm and has not been confirmed by Oracle in the sources reviewed.
What you can do
- Read any letter you receive. It will name the provider involved and explain what was exposed. Take up the free credit monitoring if it is offered.
- Freeze your credit. A freeze with the main credit bureaus is free in the US and blocks most new accounts opened in your name. You can lift it when you need to apply for credit.
- Check your medical statements. Look through explanation-of-benefits forms for treatment you did not receive, and ask your insurer about anything odd.
- Be wary of unexpected contact. Scammers use breach news to pose as hospitals, insurers or Oracle. Do not click links or give details to callers. Contact the provider using a number from its official website.
- Consider an IRS Identity Protection PIN. This helps stop someone filing a tax return with your Social Security number.
If you have been a patient at a hospital or clinic that used Cerner systems in early 2025, it is worth asking the provider whether your records were part of the incident. Letters are still going out, and some patients may not have received one yet.