A report published Oct. 6, 2026, said information from the Texas Attorney General put the number of people involved in the 2025 Oracle Health/Cerner data breach at nearly 20 million, including about 3 million Texans.
What personal and medical information was involved
Reported data categories included Social Security numbers, addresses and medical information. Christus Health and Tri-City Medical Center said the type and extent of information could vary by patient. Examples included names, doctors, diagnoses, medications and test results.
The data was on a legacy Cerner server
Oracle’s customer notice described unauthorized access to some Cerner data on an old server that had not yet been migrated to Oracle Cloud. The notice said Oracle became aware of the access on or around Feb. 20, 2025.
Health organizations that reported being affected
Christus Health in Texas and Tri-City Medical Center in California said they were among the affected Oracle customers. In March 2025, a spokesperson for the U.S. Department of Veterans Affairs said the department had not been affected at that time.
