Nearly 20 Million People. One Legacy-System Breach. What Healthcare Practices Need to Know.

What Happens When a Healthcare System’s Past Becomes Its Biggest Security Risk?

In early 2025, an unauthorized party got into legacy Cerner servers that had not yet been migrated to Oracle Cloud. In October 2026, more than a year and a half later, records obtained by Becker’s Hospital Review from Texas Attorney General filings put the reported number of affected people at about 19.9 million. Nearly 3 million of them were Texans.

Most coverage has treated this as a story about size. For a practice manager, the more useful question is where the data was sitting when it was taken.

What the Record Shows

Oracle bought Cerner in 2022 and folded it into Oracle Health. A caveat first: no full technical report on this incident is publicly available. What follows comes from breach notices, state filings and press accounts, including reporting on Oracle’s letters to its provider clients.

According to those accounts, the intruder first got in on or around January 22, 2025, using stolen customer credentials. Filings with the Texas Attorney General list credential compromise as the cause, as Becker’s Hospital Review reports. Cerner’s customer notice, as quoted by SecurityWeek, says the company became aware around February 20, 2025 of unauthorized access to data on “an old legacy server not yet migrated to the Oracle Cloud.” Oregon’s filing lists the exposure window as January 22 to April 1, 2025. The discovery date varies by document, and the HIPAA Journal reports that the later breach notice gives March 7.

The data was the full clinical picture. Reported categories include names, Social Security numbers, diagnoses, medications, test results, medical images, medical record numbers and physician names. Early reporting described the intruder as a lone actor rather than a ransomware group. That person reportedly demanded payment from affected providers to keep the data from being published, and the FBI was said to be investigating.

A Number that Kept Moving

Publicly reported figures varied sharply by state and filing date. In August 2025, notices from several states identified roughly 14,500 affected individuals in total, although Texas had already reported a far larger number. According to Becker’s, Cerner’s initial filing with the Texas Attorney General in July 2025 listed nearly 2 million people, 4,082 of them Texans. A supplemental Texas filing in July 2026 raised the reported total to 18.6 million. A filing dated September 30 added about 1.4 million more, per Becker’s, which obtained the records.

Those figures are not a single running tally. They come from different filings, in different states, counting people in different ways.

The 19.9 million figure has caveats of its own. The HIPAA Journal noted that it was not independently verified and that Oracle Health has not publicly said how many clients or individuals were affected. When that report ran in early October, the federal breach portal at HHS still carried a placeholder entry of 501 people.

The hospital count is also unsettled. An attorney told one plaintiff’s lawyer that as many as 80 hospitals may have been involved, while Becker’s puts the number of publicly identified hospitals and health systems at at least 29. Some providers have said they did not receive lists of affected patients until November 2025, about eleven months after the intrusion.

Why “Legacy” Is the Interesting Word

It would be easy to write that old servers were hacked because they were old. The public record doesn’t support that. Reporting consistently says the attacker used stolen credentials, and no source I found identifies a software flaw in the servers. What other controls were in place, such as multi-factor authentication, network restrictions or log monitoring, hasn’t been publicly described. Nobody outside the investigation can say how much the servers’ status contributed, and the absence of any particular safeguard shouldn’t be assumed.

What the record does establish is narrower. The servers had not been migrated to Oracle Cloud, and patient data from many provider organizations was still reachable on them. Oracle has said its cloud environment was not affected. John Strand of Black Hills Information Security told the HIPAA Journal that an acquirer is still responsible for what it buys, whether or not those systems have been migrated.

That is a point worth taking back to your own office, because practices have their own versions of this problem. There may be an EHR that was “replaced” years ago but never fully shut down, an archive server in a closet, or a read-only instance kept for records requests. Each of them is a place where patient data lives and where it’s unclear whose job it is to protect it.

Who Tells the Patient

Oracle Health told its provider clients that each of them must decide whether the incident is a reportable HIPAA breach and must notify its own patients. Two clocks matter here.

A business associate must notify the covered entity without unreasonable delay, and no later than 60 calendar days after discovery. The covered entity’s own clock runs from when it, or its agent, knew or should have known of the breach. HHS has said that if the vendor acts as the practice’s agent, the vendor’s discovery date can be imputed to the practice. If the vendor is an independent contractor, the clock generally starts when the vendor tells you. Which applies depends on the actual relationship, so ask your counsel where each vendor falls. Delegating the mailing of notices does not shift the responsibility for them.

In practice, a practice can end up responsible for informing patients about a breach at a vendor it doesn’t control, on a system it may not have known was still in use.

Questions to Put to Your EHR Vendor

None of these is exotic. Most vendors will have answers, and the quality of the answer tells you something either way.

• Where does our old data physically and logically live now? That includes systems retired in earlier migrations. Ask for a list.

• When a system is decommissioned, what actually happens to the data on it? Is it migrated, archived under the same controls, or destroyed? Can they show a record of that?

• What controls protect access to any legacy or archive environment? That means multi-factor authentication, credential rotation, and logging that someone reviews.

• How are customer-held credentials for those environments managed, and who monitors for their misuse?

• What is the contractual deadline for telling us about an incident that touches our patients? Do we get a list of affected individuals, and how fast?

• Does the business associate agreement cover legacy and acquired systems explicitly, or only the current product?

Then turn the same lens on your own office. List every system that holds patient data, including the ones nobody uses. If you can’t produce that list, you’ve found your first job.

What’s Still Unsettled

The regulatory backdrop is unfinished. HHS proposed a major update to the Security Rule, announced in December 2024 and published in the Federal Register in January 2025. Among other things, the proposal calls for a written technology asset inventory, a map of how patient data flows, and mandatory encryption and multi-factor authentication, with limited exceptions. HHS’s own page continues to present it as a proposed rule, and the current Security Rule remains in force. Check the status before you plan around it.

Even if the proposal changes or stalls, an inventory of where your patients’ data lives is the one item from it worth doing now.

Sources

• The HIPAA Journal, “Almost 20 Million Individuals Affected by 2025 Data Breach at Oracle Health/Cerner,” Steve Alder, October 8, 2026. https://www.hipaajournal.com/oracle-health-data-breach/

• Becker’s Hospital Review, “Oracle Health breach exposed data of nearly 20 million people, records show,” Giles Bruce, October 6, 2026. https://www.beckershospitalreview.com/healthcare-information-technology/ehrs/oracle-health-breach-exposed-data-of-nearly-20-million-people-report/

• SecurityWeek, “Oracle Health Data Breach Tally Climbs to Nearly 20 Million,” October 2026. https://www.securityweek.com/oracle-health-data-breach-tally-climbs-to-nearly-20-million/

• U.S. Department of Health and Human Services, “HIPAA Security Rule NPRM.” https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html

• 45 CFR § 164.410, Notification by a business associate. https://www.law.cornell.edu/cfr/text/45/164.410

• HHS, Breach Notification Rule, § 164.404(a), “Breaches Treated as Discovered” (preamble text, as reproduced by Bricker Graydon). https://www.brickergraydon.com/insights/resources/key/hipaa-regulations-notification-in-the-case-of-breach-notification-to-individuals-general-rule-164-404-a

• HHS, “Breach Notification for Unsecured Protected Health Information,” Federal Register, August 24, 2009 (source of the agent versus independent-contractor distinction). https://www.federalregister.gov/documents/2009/08/24/E9-20169/breach-notification-for-unsecured-protected-health-information