By Hamza Faisal
Oracle Health's 2025 data breach was far bigger than anyone first thought. Filings with the Texas attorney general put the number of people affected at 19.9 million — ten times the count in the original filing — making it one of the largest healthcare data breaches in U.S. history.
The figure surfaced in a filing published on the Texas attorney general's data breach portal on October 2, 2026, which lists Cerner Corp. — now known as Oracle Health — as reporting 2,992,244 affected Texans. The nationwide figure reported in connection with the filing is 19,929,149 people. Bloomberg first reported the nearly 20 million number on October 5, and Becker's Hospital Review confirmed it through a public records request.
How the count grew to 19.9 million
The affected population kept ballooning with every update. Cerner's initial filing in July 2025 listed nearly 2 million affected people, including just 4,082 Texans. A supplemental filing in July 2026 raised the total to 18.6 million. The latest filing, submitted September 30, added about 1.4 million more — bringing the tally to 19.9 million.
Exposed data included addresses, Social Security numbers and medical information — the full trifecta that fuels medical identity theft. According to the filings, the breach began January 22, 2025, was discovered February 20, 2025, and ended April 1, 2025. The listed cause: credential compromise.
Legacy servers, stolen credentials
Oracle alerted some healthcare customers back in March 2025 that attackers had accessed older Cerner servers whose data had not yet been migrated to Oracle's cloud. According to Oracle's customer communications, investigators found evidence that an attacker used stolen customer credentials to access a legacy server sometime after January 22, then copied information to a remote server.
Cerner is the electronic health records company Oracle acquired in June 2022 for roughly $28.3 billion — one of the biggest deals in healthcare IT. Its systems help hospitals and providers manage patient records, so one intrusion rippled across at least 29 hospitals and health systems whose patients' data sat on those aging servers.
What happens next for patients and Oracle
Oracle has not publicly confirmed the nationwide total, and the Texas attorney general's office has withheld correspondence from Cerner's attorneys — including responses to its request for a list of affected organizations and the number of Texans affected at each — pending a ruling from the Open Records Division.
Meanwhile, Oracle Health faces litigation over the incident, and the fallout is far from over. With Social Security numbers and medical records in the wind, experts say the real damage may play out over years: medical identity theft is among the hardest kinds to detect, since patients often don't learn a record was misused until a bill — or a diagnosis — shows up that was never theirs.
By Hamza Faisal
