In early October 2026, the Texas attorney general's office disclosed a number that stunned the healthcare industry: nearly 20 million people had their personal and medical data compromised in a cyberattack on Oracle Health's legacy systems. The disclosure, first reported by Bloomberg on 5 October, made the incident one of the largest healthcare data breaches in US history. And it arrived in a week that also saw Denmark's national ID register breached and a major UK retailer's app hijacked for extortion — a reminder that no sector is safe from determined attackers.
This article explains what happened in the Oracle Health breach, what data was exposed, who was affected, what you should do if your information was involved, and how to protect yourself from healthcare data breaches generally.
What happened: a timeline of the breach
The attack itself took place in early 2025, but its full scale only became public in October 2026. Here is the timeline as established by reporting:
- On or after 22 January 2025: an attacker began accessing legacy Cerner servers using compromised customer credentials, and copied data to an external server.
- 20 February 2025: Oracle Health detected the activity, began investigating, and engaged external specialists and federal law enforcement.
- March 2025: Oracle alerted some healthcare customers that patient data had been copied to an external location.
- 28 March 2025: the incident was first reported publicly; the FBI was confirmed to be investigating.
- August 2025: at least 14,485 affected individuals had been publicly identified.
- September–October 2025: multiple healthcare providers issued substitute notices and began notifying patients after receiving affected patient lists from Oracle.
- 1 October 2026: at least 29 health systems had publicly acknowledged being affected.
- 2 October 2026: the Texas attorney general disclosed that nearly 20 million people were affected, including about 3 million Texans.
- 5 October 2026: Bloomberg reported the figure publicly, bringing the breach to worldwide attention.
The long gap between the attack and the disclosure of its true scale — more than 18 months — is one of the most criticized aspects of the incident. If you want to understand the basics of staying safe online, start with our guide to cybersecurity and how to protect yourself.
What data was exposed
According to the Texas attorney general's report and subsequent coverage, the stolen records included some of the most sensitive data a person has:
- Social Security numbers
- Home addresses
- Treating physicians' names
- Diagnoses and medical conditions
- Prescriptions and medications
- Test results and medical images
Health data is especially valuable to criminals because, unlike a credit card number, a medical history cannot be cancelled or reissued. Stolen health records can be used for identity theft, insurance fraud, and highly convincing phishing attacks for years after a breach.
Who was affected
The Texas attorney general's filing put the total at nearly 20 million people, with 2,992,244 of them in Texas alone. At least 29 hospitals and health systems have publicly acknowledged being affected, and the true number of impacted providers may be higher — one sector analysis in late 2025 estimated up to 80 hospitals could be involved.
Oracle Health's customer base is broad: it serves regional hospitals and clinics as well as large federal customers including the Department of Defense and the Department of Veterans Affairs. A VA spokesperson said at the time of the March 2025 disclosure that the agency was not affected. The full effect on federal customers remains unclear.
How the attackers got in
The intrusion did not involve breaking through Oracle's modern cloud defenses. Instead, the attackers used stolen customer login credentials to access older Cerner servers that had never been migrated to Oracle Cloud.
Cerner, the electronic health records company, was acquired by Oracle in June 2022 for roughly $28.3 billion and now operates as Oracle Health. The breached data sat on legacy infrastructure — a common weak point in large organizations, where old systems linger for years after acquisitions because migrating them is expensive and disruptive.
The attackers reportedly also attempted to extort victims, demanding cryptocurrency payments to prevent the stolen data from being leaked or sold. The FBI investigated both the intrusion and the extortion attempts.
What Oracle has said — and what it hasn't
Oracle began notifying affected healthcare customers in March 2025, telling them that intruders had accessed data on old legacy servers. But for more than a year, the company did not publicly disclose how many people were affected — the 20-million figure emerged from the Texas attorney general's filing, not from Oracle itself.
Oracle declined to comment to Bloomberg on the reported figure, and as of early October 2026 had not issued a public statement confirming the total. The company faces litigation over its handling of the incident, including a class action filed in the Western District of Texas. Critics in the cybersecurity industry have described the disclosure as slow and piecemeal.
Part of a bigger pattern: Denmark and ASOS
The Oracle Health disclosure landed in the same week as two other major incidents, underscoring how widespread the problem has become.
Denmark's national ID register: 8.8 million records
Denmark disclosed that attackers abused a private company's legitimate access to the country's Central Person Register (CPR) — the national civil registry — exposing names, addresses, and national ID numbers for roughly 8.8 million people. The figure exceeds Denmark's population of about 6 million because the register also holds records for people who have died or moved abroad. Digitization minister Christina Egelund called it "a deeply serious incident." Notably, the attackers never broke in: they misused authorized access, running millions of automated lookups over September 2026 before unusual billing patterns triggered alarms in early October.
ASOS: app hijacked for extortion
UK fashion retailer ASOS saw its shares fall around 10% after hackers hijacked its app notification system to send an extortion demand directly to shoppers' phones. The rogue message, from a group calling itself "Xuanye Group," claimed to have compromised the company's data environment and demanded engagement or the data would be leaked. ASOS said names and contact details may have been accessed but that it did not believe payment card details or passwords were affected. The company's website and app continued operating normally.
The common thread: attackers increasingly target the seams — legacy servers, third-party access, notification systems — rather than the front door. Our guide to online shopping safety and spotting scams covers how to recognize the fraud attempts that often follow breaches like these.
What to do if you think you were affected
If you received care at a hospital or clinic that uses Oracle Health / Cerner systems, take these steps:
- Watch for notification letters. Affected providers are required to notify patients, usually by mail. Don't ignore letters about data breaches.
- Check your credit reports. Look for accounts or inquiries you don't recognize. In the US, you can request free reports from the major bureaus.
- Consider a credit freeze or fraud alert. A freeze restricts access to your credit file and is one of the strongest defenses against new-account identity theft.
- Review medical statements. Check explanations of benefits and bills for treatments you never received — a sign of medical identity theft, which is harder to detect than financial fraud.
- Be skeptical of unexpected contact. Criminals use breached data for phishing. Treat unsolicited calls, texts, or emails referencing your medical information with extreme caution.
- Report suspicious activity. Contact your provider, and consider filing reports with relevant authorities if you spot fraud.
How to protect yourself from healthcare data breaches
You can't control how hospitals store your data, but you can reduce your exposure:
- Use unique passwords and two-factor authentication on every patient portal account.
- Ask questions. When a provider asks for your Social Security number, ask whether it's truly required and how the data is protected.
- Share minimally. Don't volunteer more personal information on intake forms than necessary.
- Shred medical paperwork you no longer need instead of throwing it away.
- Monitor continuously. Make checking credit reports and medical statements a routine habit, not a one-time reaction.
Healthcare data breaches are not going away — medical records are simply too valuable. The best defense is assuming your data may one day be exposed and acting accordingly.