Oracle healthcare breach compromised data of 20M people

A cybersecurity breach last year of Oracle's healthcare unit compromised the personal information of nearly 20 million people, according to disclosures released by the Texas attorney general in a report issued on Friday, Oct. 2, 2026. Oracle disclosed that Social Security numbers, addresses and medical information of almost 20 million people were taken, including roughly 3 million residents of Texas.

Oracle originally alerted some customers to the cyberattack in March 2025, stating the intrusion occurred sometime after Jan. 22. At the time, the Texas-based company did not release the exact number of patient electronic health records affected. On Monday, Oct. 5, 2026, Oracle declined to comment on the new disclosure, and the Texas attorney general's office did not respond to requests for comment.

Oracle told customers in March 2025 that attackers accessed older servers from Cerner Corp., an entity Oracle acquired in 2022 for $28 billion. The company stated that the affected data had not yet been shifted to Oracle's cloud storage service. The FBI investigated the cyberattack and attempts by hackers to extort ransoms from medical companies.

Oracle's healthcare clients include regional hospitals, clinics, the Department of Defense and the Department of Veterans Affairs. Healthcare providers Christus Health in Texas and Tri-City Medical Center in California confirmed they were among many affected clients, noting compromised data could include names, doctors, diagnoses, medications and test results. It remains unclear if federal customers were impacted, though Veterans Affairs said in March 2025 that it was not affected.