Patients of hospitals that used Oracle Health’s legacy Cerner systems had names, Social Security numbers and medical information exposed in a breach that began in January 2025, and an October 2, 2026 Texas filing lists 2,992,244 Texans among the nearly 20 million people reportedly affected. A consolidated class action survived most of the defendants’ motions to dismiss in June 2026, but there is no settlement and nothing to claim yet.
Allegations Only · No Settlement Yet
This article describes a data breach and a pending class action. The statements below about the lawsuit are unproven allegations. Cerner, Oracle and the hospitals named in the case have not been found liable, no class has been certified, and there is nothing to claim at this time. This page is informational and is not legal advice.
What Happened in the Oracle Health/Cerner Data Breach?
An unauthorized person gained access to legacy Cerner servers that had not yet been migrated to Oracle Cloud and copied patient data held for Cerner’s hospital customers. Cerner Corporation’s filing in Oregon’s data breach database lists the breach window as January 22 to April 1, 2025 and the discovery date as February 20, 2025. Oracle bought Cerner in 2022 and now operates it as Oracle Health.On October 2, 2026, the Texas Attorney General’s data breach portal posted a Cerner Corporation entry listing 2,992,244 Texans notified by mail. Bloomberg reported on October 5, 2026 that the filing put the total at nearly 20 million people, and HIPAA Journal reported on October 8 that the updated total was provided to Texas on October 2. Oracle has not publicly confirmed a nationwide figure. As of HIPAA Journal’s report, the federal HHS Office for Civil Rights breach portal still showed the placeholder figure of 501 that is used when a total is not yet known.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Information Was Exposed?
The Texas Attorney General’s portal lists addresses, Social Security numbers and medical information. Notices sent to patients, as described by HIPAA Journal, list names, Social Security numbers, medical record numbers, physician names, diagnoses, medications, test results, medical images and care and treatment information. The consolidated class action complaint alleges the stolen data also included dates of birth, driver’s license numbers, dates of service and health insurance information. The data involved varies by patient and by hospital.Notification has run through Cerner’s hospital customers rather than through a single nationwide mailing. HIPAA Journal reported that Oracle told providers each one had to decide whether a reportable HIPAA breach had occurred and send its own notices, which is why patient letters and state filings have arrived over many months.
How Many People Were Affected?
The nearly 20 million figure comes from news reports on the Texas filing; the Texas portal itself shows only the 2,992,244 Texans. Cerner Corporation has two entries in Oregon’s breach database, filed July 25, 2025 and July 6, 2026, listing 1,970,332 and 8,329 people affected; the database does not break those figures down by state of residence. HIPAA Journal also reported filings showing 283,903 people in South Carolina and 69,238 in Washington. State counts overlap with the reported nationwide total and should not be added to it.Where Does the Class Action Stand?
The patient lawsuits are consolidated in the U.S. District Court for the Western District of Missouri as In re: Cerner/Oracle Data Breach Litigation, No. 4:25-cv-00259, before Judge Beth Phillips. The lead case, Blount v. Oracle Health, Inc., was filed April 11, 2025. Suits filed around the country have been transferred there by agreement of the parties, not by the Judicial Panel on Multidistrict Litigation. The consolidated complaint names Cerner and eight hospital systems: Albany Med Health System, Arkansas Heart Hospital, Baptist Health South Florida, Glens Falls Hospital, Mosaic Life Care, Huntington Hospital, Tallahassee Memorial HealthCare and Union Health System.On June 22, 2026, Judge Phillips granted in part and denied in part the motions to dismiss filed by Cerner and the hospitals. The court found the patients have standing and let the negligence claim proceed against every defendant, holding it was foreseeable that “negligently protecting Plaintiffs’ personal information would lead to it being stolen.” Breach of contract claims survived only for patients of Mosaic Life Care and Tallahassee Memorial against Cerner, and implied contract and fiduciary duty claims were dismissed against Cerner but kept against the hospitals. Claims for unjust enrichment, breach of confidence, invasion of privacy and a declaratory judgment were dismissed, along with claims under the Arkansas Deceptive Trade Practices Act and California’s Consumer Privacy Act and Privacy Rights Act. Claims under the Arizona Consumer Fraud Act, California’s Confidentiality of Medical Information Act and Unfair Competition Law remain, and several other state consumer-law claims were narrowed. These are rulings on the pleadings, not findings that any defendant is liable.
What Happens Next?
More hospital systems have been added as new suits are consolidated, and some are filing their own motions to dismiss; Atrium Health and the Charlotte-Mecklenburg Hospital Authority filed one on October 19, 2026. No class has been certified and no settlement has been announced. If the case settles, a court-approved settlement website and claim process would be announced at that time.Questions
How many people were affected by the Oracle Health/Cerner data breach?
News reports on an October 2, 2026 filing with the Texas Attorney General put the total at nearly 20 million people. The Texas portal lists 2,992,244 Texans. Oracle has not publicly confirmed a nationwide figure.
What information was exposed in the Cerner breach?
State filings and patient notices list names, addresses, Social Security numbers, medical record numbers, physician names, diagnoses, medications, test results, medical images and treatment information. The data involved varies by patient and hospital.
Is there an Oracle Health/Cerner data breach lawsuit?
Yes. Patient suits are consolidated as In re: Cerner/Oracle Data Breach Litigation, No. 4:25-cv-00259, in the Western District of Missouri. On June 22, 2026, Judge Beth Phillips let the negligence claim proceed against Cerner and the hospitals while dismissing several other claims. No defendant has been found liable.
Is there an Oracle Health data breach settlement?
No. As of October 20, 2026, no settlement had been announced and no class had been certified, so there is no claim form or deadline.
Sources
• Texas Attorney General Data Security Breach Reports portal — Cerner Corporation, 2,992,244 Texans, published October 2, 2026• Oregon Department of Justice data breach database — Cerner Corporation entries reported July 25, 2025 and July 6, 2026
• Order Granting in Part and Denying in Part Defendants’ Motions to Dismiss, In re: Cerner/Oracle Data Breach Litigation, No. 4:25-cv-00259-BP (W.D. Mo. June 22, 2026), Doc. 394
• Docket, Blount v. Oracle Health, Inc., No. 4:25-cv-00259 (W.D. Mo.)
• HIPAA Journal (updated October 8, 2026)
