Oregon's Department of Justice breach database lists two Cerner Corporation entries for the breach of Oracle Health's legacy Cerner systems, for 1,970,332 Oregonians (reported 25 July 2025) and 8,329 (reported 6 July 2026), both giving 22 January to 1 April 2025 as the breach dates and 20 February 2025 as the discovery date.

Fierce Healthcare says Cerner's entry on the Texas attorney general's breach portal, dated 2 October 2026, lists addresses, Social Security numbers and medical information, and that affected Texans were notified by US mail; HIPAA Journal says the Texas attorney general was given an updated total on 2 October and that state filings confirm 2,992,244 affected people in Texas, 283,903 in South Carolina and 69,238 in Washington.

HIPAA Journal says Oracle Health has not publicly disclosed the total number of people affected or how many Cerner clients were affected. A sample patient letter dated 25 July 2025, filed by Cerner Corporation with the California attorney general, says an unauthorised third party gained access to personal health information on legacy Cerner systems at least as early as 22 January 2025, that the provider sending it learned of the breach on 7 March 2025, and that federal law enforcement asked for patient notification to be delayed.

The letter says the information may have included names, Social Security numbers and medical record information such as medical record numbers, doctors, diagnoses, medicines, test results, images, care and treatment, and offers 24 months of Experian IdentityWorks.

HIPAA Journal says the incident involved two legacy Cerner servers that had not yet been migrated to Oracle Cloud, and that Oracle Health said its own systems were not affected.

HIPAA Journal, citing a Bloomberg report of a Texas AG filing, puts the total at almost 20 million; this has not been independently verified.

Correction (23 Oct 2026): removed an extortionist's ransom demand.

Correction (23 Oct 2026): re-sourced to HIPAA Journal, Fierce Healthcare, the Oregon Department of Justice breach database and the California attorney general's sample letter; removed details we could not verify from a source we can recheck; removed the third-hand nationwide total from the headline and kept it only as one attributed line; Oregon figures are now given as filed. (source: https://www.hipaajournal.com/oracle-health-data-breach/)