Oracle Health/Cerner Data Breach (At Least 2.65 Million)
The 2025 Oracle Health/Cerner data breach involved unauthorized access to legacy Cerner systems beginning as early as January 22, 2025.
This classification is based on a reviewed lower bound; the actual impact and severity may be higher.
Exposed Data Types
1 sensitive4- Medical information
- Names
- Physical addresses
- Social security numbers
About This Breach
The Texas Attorney General record lists 2,658,388 affected people in Texas alone, so the verified scope is at least that large; a definitive nationwide total has not yet been published.
Oracle Health, formerly Cerner Corporation, provides electronic health record technology to hospitals and other healthcare organizations. The incident affected historical patient data associated with multiple providers; CHRISTUS Health said its current systems and clinical services were not affected.
How Did the Incident Occur?
According to official healthcare-provider notices, an unauthorized third party accessed legacy Cerner systems maintained by Oracle Health and obtained data. A customer notification quoted by TechCrunch says Oracle became aware of the event around February 20, 2025. Public documents do not disclose the initial access method, the exact end date, or the responsible person, and this incident should not be confused with a separate Oracle Cloud allegation.
What Information Was Affected?
The Texas record lists names, addresses, Social security numbers, and medical information. CHRISTUS Health said the information could also include laboratory orders, blood-bank records, medical record numbers, physicians, diagnoses, medications, and test results, with the combination varying by person. These categories should not be assumed to have applied together to every individual.
How Did Oracle Health and Providers Respond?
According to CHRISTUS Health, Oracle Health opened an investigation and worked with external cybersecurity specialists and federal law enforcement. Law enforcement asked affected organizations to delay notices while critical investigative steps were completed. After receiving its affected-patient list, CHRISTUS Health mailed letters and offered two years of credit monitoring and identity-protection services.
What Should Affected People Do?
People who receive a notice from Oracle Health, Cerner, or a healthcare provider should use the data scope stated in their own letter. Health-insurance explanations of benefits, medical bills, and credit reports can be checked for unfamiliar services or activity. When a Social Security number is involved, a free credit freeze, fraud alert, and IRS Identity Protection PIN may be appropriate; notice links should be verified through the provider's official website.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
