Oracle Health breach exposes personal and medical data of nearly 20 million patients

Investigators say the intrusion began after a hacker obtained customer credentials and accessed a legacy Cerner server that had not yet been moved to Oracle Cloud, copying data to an external location. Oracle Health, the unit formed after Oracle's 2022 acquisition of Cerner, has not publicly confirmed the full national figure, but filings with the Texas Attorney General list 2,992,244 Texas residents, while other states report additional hundreds of thousands of affected individuals.

The breach was first reported to healthcare customers in March 2025, and the attacker, identified only as "Andrew," allegedly demanded multimillion-dollar cryptocurrency payments to refrain from publishing the stolen records. The compromised data spans full names, Social Security numbers, medical record numbers, diagnoses, prescriptions, test results, images and treatment details. Experts warn that such information can be leveraged for sophisticated scams, identity theft and fraudulent medical claims, prompting patients to monitor credit, freeze accounts and watch for suspicious activity.