Oracle Health Data Breach Reportedly Affects Nearly 20 Million People

A cybersecurity breach involving Oracle’s healthcare business has reportedly exposed personal and medical information belonging to nearly 20 million people, highlighting the growing security risks surrounding digital healthcare systems.

According to information released by the Texas Attorney General, the affected data included Social Security numbers, addresses and medical information. Nearly 3 million affected individuals were reportedly based in Texas. The breach occurred in 2025 but details about its scale have only recently emerged.

Oracle had previously notified some customers about the cyberattack in March 2025. The company said attackers gained access to older servers associated with Cerner, the electronic health-record business Oracle acquired in 2022. Some affected healthcare organizations reported that exposed information could include patient names, diagnoses, medications, doctors and test results.

The incident raises significant concerns for healthcare providers that increasingly depend on technology companies to store and process sensitive patient information. Unlike ordinary personal data, medical records can reveal highly private details about an individual's health and treatment history.

The breach also demonstrates why cybersecurity has become an essential part of healthcare infrastructure. Hospitals, clinics and health-technology providers must protect patient information while ensuring that legacy systems, connected databases and third-party platforms are properly secured.

As healthcare continues its transition toward digital records and cloud-based services, the Oracle incident could add pressure on providers and technology vendors to strengthen security controls, improve breach detection and carefully assess the risks associated with older systems.