One of the largest health data breaches of the decade finally has a number. A Texas attorney general data breach portal entry published October 2 shows Oracle Health’s 2025 breach affected nearly 20 million people, including 2,992,244 Texans. Oracle has not publicly confirmed this figure. Bloomberg reported the filing on October 5, and Oracle declined to comment.
The intrusion happened in January 2025. What is new is the scale: Oracle never announced the number publicly. It surfaced because the company disclosed the total to the Texas attorney general, whose portal entry Bloomberg reported on October 5.
What to do now
Start with the freeze. If your Social Security number was in this breach, and with nearly 20 million people affected it is worth assuming it might have been, freeze your credit at all three bureaus. It is free: Equifax, Experian, TransUnion. A freeze locks your file. A fraud alert only asks lenders to verify your identity first. With SSNs exposed, you want the lock. Check your existing accounts for anything unfamiliar at annualcreditreport.com, also free.
Then the part most breach guides skip. A credit freeze does nothing against medical identity theft. Someone using your name to get prescriptions or treatment never touches your credit file. Pull every Explanation of Benefits your insurer sent this year and look for care you did not receive. Request your medical records and ask for an accounting of disclosures. If you find something wrong, file at identitytheft.gov. That is the FTC’s official reporting site, and it builds a personal recovery plan for you.
Third, the IRS Identity Protection PIN. It is a free six-digit number, renewed every year, that blocks anyone from e-filing a tax return with your SSN. Anyone can opt in at irs.gov/IPPIN. Do it before tax season, not during it. The IRS will never call, email, or text asking for your PIN.
And read your mailbox carefully. Most notifications come from your hospital or health system. Oracle Health privately contacted some affected individuals directly as well, but providers are sending the bulk of the letters. Scammers know this too. Verify any letter through your provider’s official website or a known phone number, never through contact details in an unsolicited message.
How nearly 20 million people’s data walked out the door
January 2025. Someone used stolen customer credentials to get into two legacy Cerner servers that Oracle had not finished migrating to its own cloud, then copied patient data to a remote server. Oracle’s notice to customers dates detection to February 20, 2025. The formal breach notice says March 7. The Oregon attorney general puts the intrusion window at January 22 to April 1.
The detail that matters: these were old Cerner servers, not Oracle Cloud. Oracle bought Cerner for $28.3 billion in June 2022 and spent the years after moving everything onto its infrastructure. The servers that got hit were the ones still waiting in line. Oracle told customers in April 2025 that Oracle Cloud Infrastructure, its modern cloud, had not been breached. The statement was OCI-specific; in a separate 2025 incident, researchers accused Oracle of “splitting hairs” over the OCI-versus-Cloud-Classic distinction. Either way, it is beside the point here: the patient data was on legacy Cerner servers, not in Oracle’s cloud.
The attacker didn’t just steal the data. According to BleepingComputer, a threat actor known as “Andrew” demanded millions of dollars in cryptocurrency to keep the data from being leaked or sold, and set up public websites about the breach to pressure victims. The FBI investigated the extortion attempts, Bloomberg reported in March 2025.
What was exposed
Names, Social Security numbers, addresses, diagnoses, care and treatment information, medications, test results, medical images, medical record numbers, physician names. Some notices add dates of birth and insurance information. CHRISTUS Health, one of the affected systems, says exactly what was taken varies by patient. Not everyone lost everything. Do not assume the worst row applies to you, and do not assume the mildest one does either.
The scale, honestly
Nearly twenty million is roughly a tenth of the Change Healthcare breach. That one finished at 192.7 million people, per the final HHS count in August 2025, making it the largest US health breach on record. Oracle’s is still among the decade’s largest. It is about one in seventeen Americans.
What Oracle did, and didn’t do
Oracle never made a public announcement. It alerted customers in March 2025, offered to fund credit monitoring and provide letter templates, and said notifying patients was each provider’s responsibility under HIPAA. CHRISTUS Health is sending letters with two years of free monitoring. At least 29 health systems have publicly acknowledged they were affected.
Notifications were slow everywhere. Law enforcement asked providers to hold off while the FBI investigated, and some hospitals did not receive their patient lists until fall 2025, months after the January intrusion. One concrete case: Huntsville Hospital learned of the breach in August 2025 but did not notify patients until June 17, 2026. Whether any ransom was paid, or what has become of the stolen data, remains unknown.
Dozens of lawsuits have been filed and consolidated into a federal case in Missouri, where a judge ruled in June 2026 that claims against Oracle Health and eight health systems could proceed. A separate suit in West Texas alleges Oracle blew past the state’s 60-day disclosure window.
Oracle spent $28.3 billion on Cerner and left patient data sitting on servers it had not gotten around to moving. Then it said nothing in public about the scale for over a year — customers were notified in March 2025, but the real number sat in its own filings to regulators. The breach is bad. The silence about its size is the story.
Corrected Oct 10, 2026: added the extortion detail, corrected the lawsuit count, qualified Oracle’s cloud statement, fixed notification wording and the notification-delay timeline; sourced key claims, added the Huntsville Hospital notification-delay example, and tightened “nearly” hedging throughout.
How do I know if my data was in the Oracle Health breach?
Watch for a notification letter, most likely from your hospital or health system. Providers are sending their own notices. If you received care at a hospital that uses Oracle Health or Cerner systems, contact the provider directly and ask whether it was affected.
Does a credit freeze protect against medical identity theft?
No. A freeze locks your credit file, but medical identity theft means someone uses your name or insurance information to receive care. Check your Explanation of Benefits statements for treatment you did not receive, request your medical records, and report fraud at identitytheft.gov.
