Cerner

Disclosed Jun 17, 202519,929,149 affectedConfirmed

Cerner reported that it experienced a cyberattack that compromised the protected health information (PHI) of 501 individuals. Cerner was acquired by Oracle Corporation in 2022, and as a result, the investigation has closed since Cerner is no longer a covered entity.

What is known

People affected	19,929,149 (as reported by the organization)
Disclosed	Jun 17, 2025
Discovered	Feb 20, 2025
Happened	Jan 22, 2025
Attack	Hacking
Data exposed	Social Security numbersHealthAddressesNames
Sector	Tech · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Cerner

Official noticeatg.wa.gov

Washington Attorney General breach notice: Cerner

Official noticejustice.oregon.gov

Oregon DOJ breach notice: Cerner

Official noticeoag.my.site.com

Texas Attorney General data security breach report BR-0005159: Cerner

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Cerner (Business Associate, MO)

Notices filed

TotalJun 17, 2025

HHS archive501 people

Residents of CAJul 25, 2025

California AGCount not stated

Residents of WAJul 25, 2025

Washington AG67,911 people

Residents of ORJul 25, 2025

Oregon DOJ1,970,332 people

Residents of ORJul 6

Oregon DOJ8,329 people

Residents of TXJul 7

Texas AG2,658,388 people

Residents of TXOct 2

Texas AG2,992,244 people

Other breaches at Cerner

Breach, details not statedExposed names, Social Security numbers and health records. Reported to the Vermont AG.HealthcareUSOct 5

History of this record

records2026-10-03

18565730 to 19929149by dailySource

disclosed2026-09-25

2025-07-25 to 2025-06-17by backfillSource

summary2026-09-25

empty to Cerner reported that it experienced a cyberattack that compromised the protected health information (PHI) of 501 individuals. Cerner was acquired by Oracle Corporation in 2022, and as a result, the investigation has closed since Cerner is nby backfillSource

data_types2026-09-25

[] to ["ssn","health","addresses","names"]by backfillSource

records_basis2026-09-25

empty to organizationby backfillSource

records2026-09-25

empty to 18565730by backfillSource

attack2026-09-25

unknown to hackingby backfillSource

discovered2026-09-25

empty to 2025-02-20by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Cerner