Cerner data breach: legacy health record systems accessed from January 2025; notices delayed

Oregon's Department of Justice holds two Cerner reports. The first, sent July 25, 2025, covers 1,970,332 people, with a breach window from January 22 to April 1, 2025 and discovery on February 20, 2025. A second, sent June 22, 2026, adds 8,329 people for the same window. Together they come to 1,978,661. That is fewer than the 2,992,244 Texans on Texas' list, so Oregon's reports do not cover every notice sent for this incident.

What happened in the Cerner data breach?

The letter filed with California is written by a provider whose name is redacted in the public copy, about "our electronic health record (EHR) vendor, Cerner". It says the provider learned on March 7, 2025 that an unauthorized third party had gained access to and obtained data the vendor maintained, and that the provider's own systems were not affected. It says the vendor later told the provider that federal law enforcement had asked for patient notification to be delayed.

Date	What the letter and the regulators' records say
January 22, 2025	Earliest date of access the vendor's investigation found; breach date on California's record and Washington's list
March 7, 2025	The provider learns of the access
July 25, 2025	Notice recorded by California; Washington records a notice naming Baptist Health South Florida
January 31, 2026	Enrollment deadline for the Experian offer in the sample letter
October 2, 2026	Cerner Corporation report posted on the Texas attorney general's list

The Texas report came more than a year after the first notices elsewhere. Texas's list does not say whether it covers new notices or a late filing; it is the largest single count of residents that any state list fetched for this page records for the incident.

What information was involved?

The sample letter says the information may have included names, Social Security numbers and information in patient medical records, such as medical record numbers, doctors, diagnoses, medicines, test results, images, care and treatment. Texas lists addresses, Social Security numbers and medical information; Washington lists names, Social Security numbers, medical information and "other".

How many people were affected?

Regulator	What it counts	Number
Texas attorney general	Texans	2,992,244
Washington attorney general	Washingtonians (Baptist Health South Florida notice)	69,238

No total across all providers appears on the lists fetched for this page. Because each provider sends its own letters, people may get a letter from their hospital rather than from Cerner. Cerner is fourth in the Texas ranking.

What was offered to people who got a letter?

The sample letter offers Experian IdentityWorks Credit Plus 3B for 24 months in eligible jurisdictions, with identity restoration available for 24 months from the letter date without any action. Its enrollment deadline was January 31, 2026. Letters sent by other providers, or later, may carry other terms. The credit monitoring offers guide compares offers.

Why did I get a letter about Cerner?

Your hospital or clinic used Cerner's electronic health record systems, and your records were on the legacy systems involved. The guide to letters from companies you never dealt with explains vendor breaches.

What the documents leave open

• How many providers and patients are involved in total.
• How the third party got into the legacy systems.
• What the October 2026 Texas report covers.