Reported by 1 outlet
Oracle Health Data Breach Tally Climbs to Nearly 20 Million
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.02 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.1 / 10 = base × recency + community
Analysis
Oracle Health's legacy Cerner breach now affects nearly 20 million people, per Bloomberg and a Texas attorney general report. The attack occurred early last year through an unmigrated server using stolen customer credentials, with data copied to a remote server after January 22, 2025. The tally far exceeds earlier filings; Oracle has not publicly confirmed the number.
Timeline
-
original reporting
Oracle Health Data Breach Tally Climbs to Nearly 20 Million
securityweek.com · 5d ago · October 8th, 2026
The personal and medical information of nearly 20 million people was compromised in a cyberattack on Oracle Health’s legacy Cerner systems early last year, Bloomberg reported, citing a report from the Texas attorney general. The figure is far higher than the counts that surfaced in earlier filings and patient notifications. Oracle has not made a public statement on the number of affected individuals and declined to comment to Bloomberg . Cerner, an electronic health record (EHR) vendor, became part of Oracle in June 2022, after a deal that valued the company at roughly $28.3 billion. The business now operates as Oracle Health. Oracle began alerting healthcare customers in March 2025. “We are writing to inform you that, on or around February 20, 2025, we became aware of a cybersecurity event involving unauthorized access to some amount of your Cerner data that was on an old legacy server not yet migrated to the Oracle Cloud,” its notice read. Oracle told customers that the available evidence suggested the attacker had used stolen customer credentials to access the server sometime after January 22, 2025, and had copied data to a remote server. Sources told BleepingComputer at the time that the extortion attempts against affected hospitals came from an individual threat actor known as ‘Andrew’. The actor had not claimed links to any established ransomware or extortion gang. To keep the stolen data from being leaked or sold, the hacker d