Cyberattack on Oracle Health May Have Exposed Data of Nearly 20 Million Patients

When a patient goes to a doctor, they take it for granted that their health information will remain confidential. But a huge cyberattack linked to Oracle Health in the United States has raised big questions over that very trust — it has been learned that the personal and medical information of nearly 20 million people has been exposed.

According to information in documents submitted to the Texas Attorney General, an estimated 19,929,149 people's information was affected in the cyberattack on Oracle's legacy Cerner system. Cerner's listing was published on the Texas Attorney General's official data breach portal on October 2, 2026, where 2,992,244 residents of Texas alone were shown as affected.

Oracle, however, has not separately confirmed this nationwide total number of affected people in a public statement. Even so, if the published scale proves true, the incident will become one of the largest health data breach incidents in US history.

Cerner is an electronic health records technology company, which Oracle bought in June 2022 for about $28.3 billion. The business is now operated under the name 'Oracle Health.' Hospitals and healthcare organisations store patient information using Cerner's technology, so if unauthorised access occurs in these systems, the information of patients at many organisations is put at risk all at once.

The problem began in early 2025. In March 2025, Oracle began notifying affected healthcare customers that unauthorised access had been detected in the legacy Cerner system. According to the company's customer communications, they became aware of the incident around February 20.

Investigators found evidence that the attacker used stolen customer login information to enter a legacy server at some point after January 22 and copied data from there to another server elsewhere. That server had not yet been migrated to the Oracle Cloud.

However, the investigation did not establish that the server's age was the cause of this breach. How exactly the attacker obtained the stolen login information is also still not clear. It is this very lack of clarity that brings forward the uncomfortable question: even after hospital technology has been modernised, how much sensitive patient information is lying in the old systems?

For patients, the concern is far bigger than just stolen passwords. According to reports, the attackers may have obtained Social Security numbers, details of diagnoses, and even medical images.

Such information creates a risk of medical identity theft — where attempts may be made to receive treatment or file insurance claims using someone else's identity. This risk does not end simply by changing a password, because information such as a diagnosis or a Social Security number cannot be changed.

Although the incident occurred about a year and a half ago, its full scale is still emerging step by step. Notifying those affected, the final outcome of the investigation, and possible legal proceedings — it is through these that the final picture of this data breach will become clear over the coming months.

As the spread of digital records in the health sector grows, this incident keeps reminding us that if the security of old systems is neglected, millions of patients have to pay the price.