Oracle Health data breach exposes nearly 20 million patients

When you visit a doctor or hospital, you expect your medical information to stay private. After all, your health records can reveal some of the most personal details about your life. Now, a massive cyberattack involving Oracle Health is raising serious questions about how well that information is protected.

Nearly 20 million people reportedly had their personal and medical information compromised in a cyberattack involving older Cerner systems. The attack dates back to early 2025, but new details about its reach are still emerging. For patients, the concern goes well beyond stolen passwords. Hackers may have obtained Social Security numbers, diagnoses and even medical images.

Join our upcoming CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money

In this free live online class, Kurt "CyberGuy" Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season. You’ll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.

Join us Saturday, October 31, at 11 AM ET / 8 AM PT. Register free now at CyberGuyLive.com.

MEDICAL IDENTITY THEFT FOLLOWS YOU INTO THE DOCTOR'S OFFICE

The Oracle Health data breach appears to be much larger than earlier patient notifications suggested. According to figures reported in filings with the Texas Attorney General, the personal and medical information of approximately 19.9 million people was compromised in a cyberattack involving legacy Cerner systems. The Texas Attorney General's official data breach portal published Cerner's entry on October 2, 2026. It lists 2,992,244 affected Texas residents. The nationwide figure reported in connection with the filing is 19,929,149 people.

Oracle has not separately confirmed the nationwide total in a public statement. Still, the reported scale would place this incident among the largest healthcare data breaches in U.S. history. The attack involved older systems belonging to Cerner, an electronic health records company Oracle acquired in June 2022 for approximately $28.3 billion. The business now operates as Oracle Health. Cerner's technology helps hospitals and healthcare providers manage patient information. As a result, unauthorized access to those systems can expose records belonging to patients across multiple healthcare organizations.

The trouble began in early 2025. Oracle started notifying affected healthcare customers in March after discovering unauthorized access involving older Cerner systems. According to Oracle's customer communications, the company became aware of the incident around February 20, 2025. Investigators found evidence suggesting that an attacker used stolen customer credentials to access a legacy server sometime after January 22. The attacker then copied information to a remote server.

The server had not yet been migrated to Oracle Cloud. However, investigators have not publicly established that the server's age caused the breach. The precise way the attacker obtained the stolen credentials also remains unclear. This raises an uncomfortable question. How much sensitive patient information remains on older healthcare systems, even after a major technology company takes ownership?

The attacker allegedly tried to turn the stolen information into a multimillion-dollar payday. According to earlier BleepingComputer reporting, an individual using the name "Andrew" contacted affected hospitals and demanded cryptocurrency payments. The attacker reportedly threatened to leak or sell stolen patient information unless the victims paid.

The individual also allegedly created public websites about the breach to increase pressure on healthcare organizations. At the time, researchers had not established a connection between the attacker and a known ransomware or extortion group. For hospitals, that creates a difficult situation. Even if an organization pays, there is no guarantee the criminal will delete the stolen records or refrain from selling copies. Meanwhile, patients may have no idea their information is being used as leverage.

What personal and medical information was stolen?

A sample breach notification filed with California regulators provides a closer look at the information potentially exposed.

Depending on the patient, the compromised records may have included:

The exact information exposed can vary from person to person. However, the combination of personal identifiers and medical details makes this incident particularly troubling. Unlike a stolen credit card, you cannot simply cancel your medical history and request a replacement. Your diagnoses, treatment records and past prescriptions can remain sensitive for years.

Criminals could potentially use that information to create convincing medical scams, impersonate patients or commit identity theft. They may also combine medical details with other stolen information to make fraudulent calls and emails appear more credible.

FAKE PATIENT PORTAL SCAM CAN STEAL YOUR LOGIN AND INFECT YOUR PC

State breach filings offer a clearer view of the attack's scale. The Texas attorney general's October 2, 2026, filing lists 2,992,244 affected residents in Texas alone. Other state notifications show how widely the incident spread. Oregon reported 1,978,661 affected residents, while South Carolina identified 283,903. Washington also reported 69,238 people whose information was compromised.

These figures represent portions of the overall incident and should not be added to the nationwide total of nearly 20 million. Meanwhile, filings with Oregon regulators identify January 22 through April 1, 2025, as the reported breach period, with February 20 listed as the discovery date. These disclosures show how complicated healthcare breach reporting can become. Patients in different states may receive notifications at different times, while the full impact can take months or longer to emerge.

Unfortunately, healthcare organizations have become attractive targets for cybercriminals. Medical records contain information that can support identity theft and fraud long after an initial attack. One of the biggest examples came in 2024, when attackers targeted Change Healthcare, a subsidiary of UnitedHealth Group. That breach ultimately affected approximately 192.7 million people.

The Oracle Health incident appears smaller by comparison. Still, a reported 20 million affected individuals represents an enormous amount of sensitive information. The incident also raises questions about how healthcare organizations protect records stored on older systems. Those systems can remain essential to daily operations, even as companies upgrade their technology. In this case, investigators identified stolen credentials as the reported access method, rather than a publicly confirmed vulnerability in the legacy server. We reached out to Oracle Health for comment, but did not hear back before our deadline.

You may have never heard of Cerner, even if your hospital uses its technology. That makes it harder to know whether your records were involved. However, there are practical steps you can take now to reduce the risk of identity theft and medical fraud.

Check your mail for notices from Cerner, Oracle Health or a healthcare provider you have visited. The notification should explain what information may have been exposed and whether any protective services are available. You can also contact your hospital's privacy office directly. Avoid clicking links in unexpected messages claiming you need to verify your medical records.

A credit freeze can help prevent criminals from opening new credit accounts using your identity. You can request one for free through Equifax, Experian and TransUnion. You'll need to contact all three bureaus separately. A freeze will not prevent every form of identity theft, but it can block an important route criminals use.

Review your health insurance explanation of benefits statements for appointments, treatments or prescriptions you do not recognize. Also, look for unfamiliar providers or incorrect information in your medical records. Contact your insurer and healthcare provider if something looks suspicious. Medical identity theft can lead to fraudulent bills and inaccurate patient records, so catching problems early is important.

A healthcare breach can create opportunities for phishing emails and malicious attachments. Strong antivirus software can help detect malware, suspicious downloads and some dangerous links before they cause harm. Keep your devices updated and avoid downloading files from unexpected healthcare messages. Antivirus protection cannot undo the Oracle Health breach, but it can help defend against attacks that follow it. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

THE SCAMMER AT YOUR DOCTOR'S OFFICE MAY ALREADY KNOW WHO YOU ARE

Someone who knows your doctor's name or recent treatment details may sound legitimate over the phone. Criminals could use stolen information to impersonate healthcare workers, demand payments or ask you to confirm your Social Security number. Hang up and call the provider using a number from its official website or your insurance card. Never assume a caller is legitimate simply because they know something about your medical history.

Use unique passwords for healthcare portals and enable two-factor authentication (2FA) wherever available. A password manager can help you create and store strong passwords without reusing them. If you suspect your account credentials were compromised, change the affected password immediately. Remember, changing a password will not retrieve stolen medical records, but it can help protect your accounts from additional unauthorized access.

If your Social Security number was exposed, an identity theft protection service may help you monitor for suspicious activity involving your personal information. Some services also offer alerts and assistance with recovery. Review any free monitoring offered through your breach notification before purchasing a separate plan. Keep in mind that monitoring services cannot guarantee prevention of identity theft or detect every form of medical fraud. See my tips and best picks on Best Identity Theft Protection at Cyberguy.com

What concerns me most about the Oracle Health breach is how little control patients have over where their medical information ends up. You can be extremely careful with your passwords and avoid suspicious links, yet your most sensitive records may still sit on a server you never knew existed. The fact that this attack involved a legacy server makes the situation even more frustrating. Investigators have identified stolen credentials as the reported access method, but we still don't know exactly how those credentials were compromised. When a company acquires a healthcare technology provider, protecting the information already stored in those systems should be a priority. Patients deserve to know that their records remain secure throughout technology upgrades. And consider the timing. The attack dates back to early 2025, yet its potential scale is becoming clearer in October 2026. That's a long time for people to remain uncertain about what happened to their information. Healthcare organizations need to do a better job protecting patient records and communicating clearly when something goes wrong.

Would you trust a hospital with your most personal medical information if you knew it was stored on older technology, and should healthcare companies face tougher consequences when millions of patient records are exposed? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Newsletter

Copyright 2026 CyberGuy.com. All rights reserved.