The personal and protected medical information of approximately 20 million individuals was exposed in the 2025 Oracle Health data breach.
Oracle Health serves numerous large hospitals, small clinics, and government facilities, including the Department of Defense and the Department of Veterans Affairs.
Oracle Corp. disclosed the January 22, 2025, data breach in March of the same year, but the total number of victims was undetermined.
Oracle Health data breach affects 20 million people
According to the Texas Attorney General, the data breach affected 20 million people, including 3 million residents of the Lone Star State, making it the third largest healthcare data breach in the history of the United States. The data breach also affected 1,970,332 people in Oregon, 283,903 individuals in South Carolina, and 69,238 victims in Washington.
Over a dozen healthcare facilities have issued data breach notices alerting their patients that their sensitive health information was compromised. At least 80 healthcare facilities may have been affected by the Oracle Health data breach.
ChristianaCare, a Delaware-based health facility, Maryland-based LifeBridge Health, and Missouri-based Heartland Regional Medical Center have confirmed they were affected. However, the data breach did not affect their internal systems or disrupt patient care.
“On March 7, 2025, we learned that an unauthorized third party gained access to and obtained data that was maintained by our vendor. The vendor’s investigation determined that the unauthorized third party gained access to personal health information on legacy Cerner systems at least as early as January 22, 2025,” a consolidated data breach notification filed in South Carolina reads.
While the leaked information varied by individual, it included names, Social Security Numbers, doctors’ names, diagnoses, medications, test results, and other sensitive medical information. Leaking this information exposes victims to potential extortion and medical insurance fraud by cybercriminals.
In 2025, Oracle Health claimed that the hackers had accessed older Cerner servers that had not been migrated to Oracle Cloud. The Austin, Texas-based company had acquired Cerner for $28 billion, and promised to modernize its legacy systems by moving them to the cloud. According to people familiar with the matter, two Cerner servers, some of which contained recent data, were affected.
“A cloud migration can increase breach risk when the migration server still holds the records attackers want,” said Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs. “Oracle Health told affected customers in March 2025 that attackers had used compromised customer credentials to access older Cerner servers after January 22 and copy patient data to a remote location. Those servers sat outside Oracle Cloud because the data had not yet been migrated. Oracle acquired Cerner for $28 billion in 2022, but moving the destination did not remove the older copy. That is a data-lifecycle failure.”
According to Damon Small, a member of the Board of Directors at Xcape, “Exfiltrating nearly 20 million patient records proves that technical debt in healthcare M&A presents immediate, catastrophic operational liability.”
“Security leadership must mandate multi-factor authentication, rigid network isolation, and deep logging across all unmigrated environments while treating legacy infrastructure as high-risk untrusted enclaves,” Small added.
Small also asserts that the data breach refutes Larry Ellison’s bold claim that “Oracle is unhackable,” demonstrating that no organization is immune to data breaches.
While Oracle Health has not disclosed the identity of the threat actor, the attack involved a single threat actor, who leveraged stolen credentials to breach the system. The attacker attempted to extort Oracle for millions of dollars in cryptocurrency to prevent the stolen information from being leaked on the dark web, where health data fetches a premium price.
Oracle sued over health data breach
A consolidated lawsuit stemming from the Oracle Health data breach has been filed in the U.S. District Court for the Western District of Missouri. The class action lawsuit stemmed from 29 separate class actions filed across 13 states, against Oracle and 8 healthcare providers.
Some of the class members accuse the tech giant of “negligently and unlawfully” failing to protect patient information by allowing cybercriminals to access “unsecured and unencrypted private information.”
They also accused Oracle of “failure to implement adequate and reasonable cybersecurity procedures and protocols” and of delaying the sending of the necessary notifications. The tech giant is also accused of violating HIPAA regulations, the Federal Trade Commission Act, and numerous California privacy laws.
However, Oracle is not solely responsible for the breach, according to a federal judge who allowed the lawsuit to proceed. The judge argued that the responsibility for protecting personal information was not delegable, and that individual healthcare facilities could not be absolved of blame. The ruling underscored the need for primary organizations to vet their third-party vendors before entrusting them with sensitive health information.
“This news story should serve as a warning for anybody looking to acquire another company,” said John Strand, Owner, Black Hills Information Security. “Security due diligence absolutely needs to be part of the mergers and acquisitions process. It’s something we spend a lot of time doing for our customers. I don’t like the fact that Oracle is kind of hand-waving this away by saying these were legacy systems that hadn’t been migrated to their secure cloud services yet. They’re still responsible. The moment you acquire a company, you become responsible for all aspects of that company, and that includes its security vulnerabilities.”
