Oracle Health Data Breach Tally Climbs to Nearly 20 Million

In early 2025, Oracle Health (formerly Cerner) experienced a cybersecurity incident involving unauthorized access to legacy servers containing patient data. The attacker used stolen customer credentials to access and copy data from the server. The breach was discovered around February 20, 2025, and affected nearly 20 million people, far exceeding earlier reported figures. The compromised data includes sensitive personal and medical information such as Social Security numbers and detailed patient medical records. The attacker attempted extortion by demanding millions in cryptocurrency and publicizing the breach to pressure victims. Notifications have been filed with multiple state regulators, including Texas, South Carolina, Washington, Oregon, and California. Oracle has not publicly commented on the total number of affected individuals.

The breach exposed sensitive personal and medical information of nearly 20 million individuals, including Social Security numbers and detailed health records. This level of exposure poses significant risks of identity theft, fraud, and privacy violations for affected individuals. The incident is one of the largest healthcare data breaches in the US, impacting multiple states and healthcare providers. The attacker’s extortion attempts further increased the operational and reputational impact on Oracle Health and its customers.

Oracle Health began notifying affected healthcare customers in March 2025 and has presumably taken steps to secure legacy systems and migrate data to Oracle Cloud. No public statement or official vendor advisory regarding remediation or patching is available. Patch status is not yet confirmed — check Oracle’s official communications and regulatory filings for current remediation guidance. Organizations using Oracle Health/Cerner systems should verify that legacy servers are fully migrated and secured, review access controls, and monitor for unauthorized credential use. No specific vendor-provided mitigation instructions are available in the provided data.