Oracle Health data breach in 2025 compromised data of 20M people: report
In a report issued October 2, the Texas attorney general said the company disclosed that Social Security numbers, addresses and medical information of almost 20 million people, including about 3 million Texans, Bloomberg reported.
In October 2025, a significant data breach was disclosed by Oracle Health, affecting approximately 20 million people, according to Bloomberg. The Texas Attorney General reported that the breach compromised personal information, including Social Security numbers, addresses, and medical data, belonging to nearly 20 million individuals, with around 3 million Texans impacted.
The breach occurred on January 22, 2025, when an unauthorized individual gained access to Oracle Health's Cerner system, with the incident identified on March 7, 2025. Oracle Health, which acquired Cerner in 2022 for $28 billion, has not disclosed the total number of affected clients or individuals. The breach notice stated that the unauthorized access took place on January 22, 2025, and was identified on March 7, 2025.
At least 29 health systems were reportedly affected, with 80 hospitals potentially impacted. Oracle faces multiple legal actions, including a consolidated federal class-action lawsuit in the U.S. District Court for the Western District of Missouri. Plaintiffs allege that Oracle failed to implement adequate cybersecurity measures, leading to the exfiltration of sensitive patient data, including names, Social Security numbers, dates of birth, medication details, and diagnostic information.
The lawsuit claims that Oracle violated several federal and state laws, including HIPAA and the Federal Trade Commission Act. The court has ruled that healthcare organizations cannot delegate their data protection responsibility to a vendor, a decision that may have broader implications for the industry. Oracle has not commented on the lawsuit or the Bloomberg report.
Written by urgent.news from Fierce Healthcare's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
