Oracle Health Breach Exposed Data of Nearly 20 Million People, Texas AG Says

Oracle Corp.'s healthcare unit compromised the personal information of nearly 20 million people in a cybersecurity breach last year, according to a Texas attorney general report issued Friday. The disclosure said Social Security numbers, addresses and medical data were stolen, affecting about 3 million Texans. Oracle alerted some customers in March 2025 to the attack, which it said occurred after Jan. 22, but did not disclose the number of records affected. Affected providers Christus Health and Tri-City Medical Center said compromised data could include names, Social Security numbers, doctors, diagnoses, medicines and test results. Oracle declined to comment Monday. The attackers accessed older servers from Cerner Corp., which Oracle acquired in 2022 for $28 billion, before the data was migrated to Oracle's cloud, the company said. The FBI investigated the attack and ransom attempts, Bloomberg News reported in March 2025.