In short: On October 5, 2026, the Texas Attorney General's office disclosed the real scope of the Oracle Health breach the company first reported back in March 2025: roughly 20 million patients across the US — including nearly 3 million Texans — had their data exposed. Attackers logged into outdated legacy Cerner servers using compromised customer credentials, gaining access to names, Social Security numbers, diagnoses, medication names, and lab results.
What happened
Oracle Health, formerly Cerner, is a major provider of electronic health records for hospitals; Oracle acquired Cerner in 2022. The attack hit not Oracle's own cloud infrastructure but older Cerner servers that had not yet been migrated to the new platform at the time of the breach. According to the company, unauthorized access began sometime after January 22, 2025, and attackers used legitimate customer credentials to get in — no sophisticated exploit required. Oracle first notified affected clinics in March 2025, but the real scale — nearly 20 million patients across roughly 80 US hospitals — only became public in October 2026 through the Texas disclosure.
What data is at risk
Exposed data may include names, Social Security numbers, home addresses, and the contents of medical records themselves: medical record numbers, treating physicians, diagnoses, prescribed medications, test results, and images. This is among the most sensitive data categories that can leak — usable both for direct fraud (taking out loans, fraudulent medical billing under someone else's insurance) and for targeted extortion based on sensitive diagnoses.
Why this matters beyond the US
The Oracle Health story is a textbook example of how major breaches stay underestimated for years: the incident was known for over a year and a half before its real scale became public. The cause was legacy infrastructure inherited through a corporate merger — patient data sat on old Cerner servers rather than Oracle's secured cloud platform. For anyone using digital services, including medical apps and portals, it's a reminder that a breach's real timeline doesn't end on the attack date — companies often learn the true scope of an incident months or years later.
How to protect yourself
- If you use foreign medical services or their mobile apps, review privacy settings and disable excessive third-party integration access.
- Enable two-factor authentication on your email and on accounts tied to medical and insurance services.
- Use a unique password per service via a password manager; our guide on password manager security covers how to set one up.
- Periodically check whether your data has surfaced in known breaches using the method in our piece on checking for personal data leaks.
- If you suspect an account is already compromised, step-by-step recovery actions are covered in our guide on protecting an account from a hack.
A VPN can't stop a breach on a company's own servers — that depends entirely on their infrastructure security. But it closes a related risk: interception of your own traffic when logging into email, banking, or a medical portal over open Wi-Fi. LiMP VPN runs on a no-logs policy, with plans from 69 ₽/month — details on the pricing page.