Oracle Health Data Breach Affects Nearly 20 Million Individuals

Massive Data Compromise Revealed

A cyberattack on Oracle Health's legacy Cerner systems resulted in the compromise of personal and medical information belonging to nearly 20 million individuals. This information was reported by Bloomberg, citing a report from the Texas attorney general, and represents a much higher number than earlier public disclosures.

Oracle acquired Cerner, an electronic health record vendor, in June 2022. The affected systems were older Cerner infrastructure that had not yet been migrated to Oracle Cloud.

Breach Details and Discovery

Oracle began notifying healthcare customers in March 2025 about the cybersecurity event. The company stated that unauthorized access to Cerner data on an old legacy server occurred on or around February 20, 2025. Evidence suggests the attacker used stolen customer credentials to access the server after January 22, 2025, and copied data to a remote server.

Extortion Attempts and Data Types

Sources indicated that an individual threat actor named 'Andrew' was behind extortion attempts against affected hospitals, demanding millions in cryptocurrency to prevent data leakage or sale. The hacker also created public websites to pressure victims.

The compromised data included names, Social Security numbers, medical record numbers, doctors, diagnoses, medicines, test results, images, and care and treatment information.

Scope Across States

Filings with various state regulators confirm the widespread impact. The Texas attorney general's portal lists nearly 3 million affected Texans. South Carolina and Washington reported approximately 283,000 and 69,000 affected residents, respectively. Oregon regulators noted the breach occurred between January 22 and April 1, 2025, with discovery on February 20, 2025.

Industry Impact

If the nearly 20 million figure is confirmed, this incident would rank among the largest healthcare data breaches ever recorded. Oracle has not issued a public statement regarding the total number of affected individuals and declined to comment to Bloomberg.