Nineteen months, three million Texans

The Texas attorney general keeps a public list of data breaches that affect at least 250 Texans. Search it for "Oracle" and nothing comes back. Search it for "Cerner" and there is one entry: Cerner Corporation, 2800 Rockcreek Parkway, Kansas City, Missouri. Information affected: address, Social Security number, medical information. Texans affected: 2,992,244. Notice provided to consumers: yes, by U.S. mail. Date published on the attorney general's site: 2 October 2026, a Friday.

Cerner is the electronic health records company Oracle bought in 2022 for $28bn and now runs as Oracle Health. The entry puts a number, for one state, on a breach whose size Oracle did not give in its 2025 notice to customers. On Monday Bloomberg reported, citing information released by the Texas attorney general, that the incident compromised data belonging to nearly 20 million people. Oracle declined to comment further on Monday, according to MoneyCheck, which carried Bloomberg's report; Gizmodo, which also summarised it, said it had asked Oracle for a statement. The public listing this desk read shows only the Texas figure, which is what the state's form asks for. If the national number is right, Texans are about 15 per cent of the total, on our arithmetic.

The breach itself is old news to the hospitals. In March 2025 BleepingComputer reported a notice Oracle Health had sent to affected customers. "We are writing to inform you that, on or around February 20, 2025, we became aware of a cybersecurity event involving unauthorized access to some amount of your Cerner data that was on an old legacy server not yet migrated to the Oracle Cloud," it read. Oracle said an attacker had used compromised customer credentials to get in at some point after 22 January 2025 and copied data to a remote server. Hospitals were being extorted for millions of dollars in cryptocurrency by someone calling himself "Andrew", BleepingComputer's sources said.

What made the 2025 notice unusual was who it left holding the job. Oracle Health told hospitals it would not notify patients directly, according to BleepingComputer: it was for each hospital to decide whether the theft was a breach under HIPAA, the federal health privacy law, and whether to send notices. Oracle offered to help identify affected people, supply templates, pay for credit monitoring and pay the mailing vendor. It would not send the letters on the hospitals' behalf. Its communications came on plain paper rather than letterhead, the report said, signed by Seema Verma, Oracle Health's executive vice president and general manager, and customers were directed to talk to its security office by phone rather than email.

Friday's entry is a filing under Cerner's own name. Texas law makes that a specific obligation. Under section 521.053 of the Business and Commerce Code, a business that has to notify people of a breach must tell the attorney general "as soon as practicable and not later than the 30th day after the date on which the person determines that the breach occurred" if at least 250 Texans are involved. The report must give the number of Texans affected, the number sent a notice by mail or another direct method, what the company has done and plans to do, and whether law enforcement is investigating. The attorney general publishes a list; the full report is not on it.

The list does not say when Cerner decided the breach had occurred, so it cannot show whether the filing was late. It shows dates. Oracle says it learned of the incident on or around 20 February 2025. The listing went up 589 days later, by our count. The site warns that details, "including number of affected Texans and whether notice was provided to them may change after a report is listed here". It records that notice was given by mail. It does not say who sent the letters: Cerner, the hospitals, or the mailing vendor Oracle offered to pay for.

One confusion is worth clearing up, because some coverage this week has run the two together. In March 2025 a hacker using the name rose87168 claimed to have stolen six million records from Oracle Cloud's single sign-on servers. Oracle told BleepingComputer: "There has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data." That was a separate claim about a separate system. The Oracle Health notice was careful in a different way: the server was "not yet migrated to the Oracle Cloud". Both statements can be true at once, and the second is how a breach at one of the largest cloud companies happened outside its cloud.

For Oracle's customers the number changes the conversation. Bloomberg notes that Oracle Health's clients include the Department of Defense and the Department of Veterans Affairs. Hospitals that were told in 2025 that patient notification was their job have spent a year and a half dealing with the consequences of a breach of a vendor's server. A count has now appeared, and it did not come from Oracle's own announcements. It is a row in a Texas database, under the name of the company Oracle bought.