On October 2, 2026, a new entry appeared on the Texas Attorney General's data breach portal. Cerner, the health records company Oracle bought in 2022 and now runs as Oracle Health, reported that 2,992,244 Texans were affected by a breach. Three days later, Bloomberg reported that the total across the country was close to 20 million people, citing the Texas report. SecurityWeek, which summarized the filings on October 8, noted that Oracle has not publicly confirmed how many people were affected and that a sample notification letter was also filed with California regulators.
If you run a medical or dental office in Los Angeles, you may never have used an Oracle product. This story still belongs on your desk, because the way it happened is the way breaches happen to practices of every size. An old server held data nobody was using. A customer's stolen password opened it. And when the vendor got hit, the job of telling patients landed on the vendor's customers.
What happened inside Oracle Health, in plain terms
According to Oracle's notice to its healthcare customers, as reported by SecurityWeek and BleepingComputer, Oracle became aware of the problem on or around February 20, 2025. The attacker had used stolen customer credentials to reach what Oracle called an old legacy server not yet migrated to the Oracle Cloud, sometime after January 22, 2025, and copied data to an outside server. Filings in Oregon list the breach period as January 22 through April 1, 2025.
The sample letter filed in California describes what may have been taken: names, Social Security numbers, and information from patient medical records, including record numbers, doctors, diagnoses, medicines, test results, images, and treatment details. SecurityWeek reports that hospitals were then pressured for millions of dollars in cryptocurrency by an individual calling himself "Andrew," who set up public websites about the breach to add pressure.
So why is a breach from early 2025 in the news in October 2026? Because the counting happens slowly. Each affected hospital had to work out who was involved and send its own notices, and each state posts its own filing on its own schedule. You can see some of that trail on the Texas breach portal and the California Attorney General's breach list.
The pattern is bigger than one vendor
Oracle Health is not alone. The HIPAA Journal reports that Veradigm, the practice management and records company formerly known as Allscripts, found that an attacker had used credentials stolen in one of its customers' security incidents to reach a Veradigm storage account. By June 2026, Veradigm had put the number of affected people at 2,672,036.
Two large health technology vendors, two breaches, and the same way in: a login that belonged to a customer. For a practice owner, that should change how you think about the usernames and passwords your staff use every day. Your front desk's login to a vendor portal is not just a key to your account. It may be a key to the vendor's systems too.
What was missed: three lessons for a small practice
The first lesson is about old data. Oracle's own description points to a legacy server that had not been migrated yet. Practices create the same situation all the time. You switch records systems and keep the old server running for lookups. You replace an imaging system and leave the old archive on a machine in the back room. Years later, that machine still holds full patient records, it no longer gets the attention your main system gets, and nobody remembers the passwords on it. A written data retention policy decides what you keep, for how long, and where it lives, so old data does not sit forgotten on a forgotten box.
The second lesson is about logins. If a stolen customer password can open a vendor's server, then every shared account, every password reused from a personal email, and every former employee who still has access is a risk to you and to the vendor. Every person needs their own login, every vendor portal that offers multifactor authentication should have it turned on, and access should end the day someone leaves. Where your vendors support it, phishing resistant multifactor authentication closes the gap that ordinary text message codes leave open.
The third lesson is about who carries the burden. BleepingComputer reported in March 2025 that Oracle told hospitals it would not notify patients directly. Hospitals had to decide whether HIPAA applied and whether they needed to send notices, with Oracle offering templates and agreeing to pay for credit monitoring and a mailing vendor. When your vendor is breached, the patients are still yours, and so are many of the obligations.
What your practice should do now
Start by listing every company that holds your patients' information. That usually includes your records system, your practice management or billing software, your clearinghouse, your imaging system, your patient texting or reminder service, your online forms, and your IT provider. For each one, find the business associate agreement. If you are not sure what that document must contain, our guide on what a BAA is and what it should cover explains it. Read the breach clause closely: how quickly the vendor must tell you, what it will tell you, whether it will send patient notices or leave that to you, and who pays.
Then look at the clock you would be on. Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach, and breaches affecting 500 or more people also require notice to HHS and to the media. California added its own pressure this year. Since January 1, 2026, the state's general breach law requires notice within 30 calendar days for the businesses it covers. How these rules apply to your practice depends on the facts, so have your attorney review it before an incident, not during one. Our explainer on the breach notification rule walks through the HIPAA side.
Next, go looking for old servers and old drives. Ask your IT provider for a list of every machine that holds patient data, including retired systems still plugged in. Anything you must keep should move to a supported, protected location. Anything you no longer need should be destroyed properly, with a record of how and when.
Then tighten logins across every vendor portal. Remove shared accounts, turn on multifactor authentication, and review who still has access. Do the same review for your IT provider's accounts in your systems.
Finally, update your risk analysis. HHS expects a practice's security risk analysis to reflect how patient data is actually handled, and a list of vendors with access is part of that picture. Our guide to a healthcare security risk assessment shows what a useful one covers. Remind staff, too, that any call or email claiming to be about a breach and asking for passwords should be treated as suspicious.
How GlobeVM helps practices stay ahead of vendor breaches
GlobeVM has supported businesses for 30 years and currently looks after more than 75 organizations across Southern California. Healthcare is one of the industries we focus on, and you can see how we approach medical practices and dental offices. Firewall management, endpoint protection, email filtering, and multifactor authentication are standard in every plan, and we provide 24/7 monitoring. When you call, a person in Los Angeles answers in under 15 minutes, often George or Nazy, the owners, and we work in English and Farsi.
If you want to know which of your vendors hold patient data, where your old servers are, and whether your logins would stop a stolen password, start with a free IT and security assessment or call (818) 405-9930.
Questions practices are asking about the Oracle Health breach
Were Los Angeles hospitals or practices affected?
Oracle has not published a list of affected organizations, and the public filings so far are by state. Patients who were affected receive letters that name the provider involved. If your practice shares patients with a hospital that used Cerner systems, expect some questions at the front desk, and answer only with what the letter and the hospital have said.
Our practice does not use Oracle Health. Does this matter to us?
Yes, because the method matters more than the brand. A stolen customer login and an old server waiting for migration are risks inside many practices and many vendors. The Veradigm case shows the same entry point at a different company.
Who notifies patients when a vendor is breached?
It depends on your contracts and the facts. In the Oracle Health case, BleepingComputer reported that Oracle left notification decisions to the hospitals. Your business associate agreement should spell out who does what, and your attorney should confirm how HIPAA and California law apply.
How fast would we have to notify patients?
HIPAA sets an outer limit of 60 days after discovery and requires notice without unreasonable delay. California's general breach law has required notice within 30 calendar days since January 1, 2026, for the businesses it covers. Waiting for the outer limit is rarely wise.
What is the single best protection against this kind of breach?
There is no single fix, but two habits cover a lot of ground: unique logins with multifactor authentication on every system that holds patient data, and a regular hunt for old systems that should have been retired. Our article on vendor and third party risk management covers the rest.