# Oracle Health Data Breach Exposes Nearly 20 Million Patients via Legacy Cerner Systems

> A cyberattack on Oracle Health's legacy Cerner systems compromised the personal and medical data of nearly 20 million people, state filings show.

- Published: 2026-10-18T16:56:11+00:00
- Section: Incidents
- Author: News Desk
- URL: https://newsforagent.com/news/2026-10-18/oracle-health-breach-cerner-patients
- Source: [Fox News](https://www.foxnews.com/tech/oracle-health-data-breach-exposes-nearly-20-million-patients)

## Key takeaways

- Filings with the Texas Attorney General list 19,929,149 people affected in the Oracle Health breach involving legacy Cerner systems.
- Texas reported 2,992,244 affected residents, Oregon 1,978,661, South Carolina 283,903 and Washington 69,238.
- Oracle acquired Cerner in June 2022 for approximately $28.3 billion, and the business now operates as Oracle Health.

Nearly 20 million people had personal and medical information compromised in a cyberattack involving Oracle Health's legacy Cerner systems, according to figures reported in filings with the Texas Attorney General. [Fox News](https://www.foxnews.com/tech/oracle-health-data-breach-exposes-nearly-20-million-patients) reported the nationwide figure of 19,929,149 people, which Oracle has not separately confirmed in a public statement.

## Texas Filing Puts Oracle Health Breach at 19.9 Million

The Texas Attorney General's data breach portal published Cerner's entry on October 2, 2026, listing 2,992,244 affected Texas residents. The attack involved older systems belonging to Cerner, an electronic health records company Oracle acquired in June 2022 for approximately $28.3 billion; the business now operates as Oracle Health. Cerner's technology helps hospitals and healthcare providers manage patient information, so unauthorized access can expose records belonging to patients across multiple healthcare organizations.

Oracle began notifying affected healthcare customers in March after discovering unauthorized access involving older Cerner systems, and its customer communications state the company became aware of the incident around February 20, 2025. Investigators found evidence suggesting an attacker used stolen customer credentials to access a legacy server sometime after January 22, then copied information to a remote server that had not yet been migrated to Oracle Cloud. Investigators have not publicly established that the server's age caused the breach, and the precise way the attacker obtained the credentials remains unclear.

According to earlier BleepingComputer reporting, an individual using the name "Andrew" contacted affected hospitals and demanded cryptocurrency payments, threatening to leak or sell stolen patient information unless the victims paid. A sample breach notification filed with California regulators indicates records may have included full names, Social Security numbers, medical record numbers, doctors and diagnoses, prescription medications, medical test results, medical images, and treatment and care information.

## Earlier Oracle Health Breach and Contract Scrutiny

On October 1, 2026, Becker's Hospital Review reported that the 2025 breach of legacy Cerner systems compromised patient data at 29 health systems, including Oaklawn Hospital and Great River Health. On October 13, 2026, Becker's Hospital Review reported that Democrats on Veterans' Affairs committees demanded the VA explain a contract modification that raised the Oracle Health EHR deal ceiling by over $17.5 billion. On October 14, 2026, GlobeNewswire reported that Ademi LLP is investigating potential data privacy claims from a data breach at Oracle Health, which provides cloud-based EHR systems.

## Other Healthcare and Corporate Breaches

A cybersecurity incident targeting BAE Systems disrupted the system producing and transmitting bankruptcy notices across U.S. Federal bankruptcy courts, [Rankiteo Blog](https://blog.rankiteo.com/baeuni1792110785-bae-systems-us-federal-bankruptcy-courts-cyber-attack-october-2026/) reported on October 15, 2026. CTOS Digital Bhd expects its FY2026 profit after tax and minority interests to fall by RM12 million and revenue by RM16 million due to a cybersecurity breach, [The Edge Malaysia](https://theedgemalaysia.com/node/821804) reported on October 13, 2026. Concord Eye Center, a New Hampshire ophthalmology practice, is investigating a cyberattack by hacker group Interlock that may have exposed patient and employee data, [Rankiteo Blog](https://blog.rankiteo.com/con1791931774-concord-eye-center-ransomware-october-2026/) reported on October 12, 2026.

## State Notifications and Reported Breach Period

Oregon reported 1,978,661 affected residents, South Carolina identified 283,903 and Washington reported 69,238, figures that represent portions of the overall incident. Filings with Oregon regulators identify January 22 through April 1, 2025, as the reported breach period, with February 20 listed as the discovery date.

## Companies in this story

- Oracle Health · website: https://www.oracle.com/health

---
News for Agent · https://newsforagent.com/llms.txt