Cerner: Population Totals Cannot Replace Your Patient Notice
A Texas filing, BR-0005382, published on 2 October 2026, reported 19,929,149 people, including 2,992,244 Texans, in Cerner’s 2025 legacy-system breach. BlackTree retrieved it on 8 October; it does not establish a new intrusion.
A reported population, not an audited count
The visible table identifies addresses, Social Security numbers and health-related data. The worldwide figure was in its public data response, not a displayed column. The regulator warns that entries can change. Neither dates nor total independently verify access times or the worldwide population.
What the provider’s letter actually covers
The California register links a redacted sample dated 25 July 2025. An outsider obtained patient data from legacy vendor systems; the provider’s computers were not affected. Names, those identifiers and clinical records might be involved, depending on the recipient. That does not establish uniform exposure.
Enrolment ended on 31 January 2026; restoration help was separately offered for 24 months from the letter without activation. Check your notice’s eligibility, remaining support, terms and contacts.
Use the notice you actually received
- Verify the sender independently. Reach the provider through a trusted website, portal or telephone number rather than replying to an unexpected message.
- Identify your confirmed fields. Keep the notice and distinguish what it says about your data from broader incident categories.
- Follow the provider-specific notice. Use its named contact and current official instructions, then ask the provider to clarify any affected fields or next steps that remain unclear.
- Expect contextual impersonation. Real medical or identity details can make a false call or message convincing. Do not provide codes, credentials or payment through an inbound contact.
BlackTree analysis: a population total cannot specify every recipient’s exposure. Healthcare teams still need their own cohort, field and notification checks before answering patients, not just a regulator’s aggregate.
The limits of these records
The filings supply no Oracle confirmation of the total, attacker attribution, exploit, CVE, all-customer impact, public dump or ransom payment. Neither is a complete forensic report.
Sources and observation dates
- Texas record, observed 8 October at 14:09 CEST; its total is explicitly historical.
- California entry and sample letter, observed 8 October at 14:38 CEST.
