A cybersecurity breach involving Oracle’s healthcare operations compromised personal information belonging to nearly 20 million people, according to information released by the Texas attorney general.

The exposed information reportedly included Social Security numbers, addresses and medical data. Approximately 3 million Texans were among those affected, highlighting the scale of the incident and the sensitivity of the information involved.

Oracle had notified some customers about the cyberattack in March 2025, saying the intrusion occurred sometime after January 22. At the time, however, the company did not disclose how many patients’ electronic health records had been affected.

Medical Information Was Among the Data Exposed

The severity of the exposure varied among healthcare organizations. Christus Health in Texas and Tri-City Medical Center in California said compromised information could include names, Social Security numbers, physicians, diagnoses, medications and test results.

The affected organizations indicated that they were among numerous Oracle healthcare customers impacted by the breach.

The combination of financial identifiers and medical information makes the incident particularly significant for affected patients. However, the source material does not specify how each category of information was distributed across the nearly 20 million individuals.

Oracle’s Healthcare Customer Base Adds to the Scope

Oracle’s healthcare customers include regional hospitals and clinics as well as federal government organizations, including the Department of Defense and Department of Veterans Affairs.

The extent to which the breach affected Oracle’s federal customers remains unclear based on the information provided. A Veterans Affairs spokesperson said following Oracle’s March 2025 disclosure that the agency had not been affected.

The uncertainty surrounding individual customers illustrates the complexity of assessing the full consequences of a breach involving a large healthcare technology provider.

Legacy Cerner Systems Were Involved

The cyberattack also highlights the challenges associated with integrating legacy technology following a major acquisition.

Oracle told customers in its March 2025 notice that attackers gained access to older servers originating from Cerner Corp., the healthcare technology company Oracle acquired in 2022 for $28 billion.

According to the notice, the affected data had not yet been transferred to Oracle’s cloud storage service. The incident therefore involved infrastructure that remained outside the company’s newer cloud environment.

Federal Investigation Adds Another Dimension

The FBI investigated the cyberattack as well as attempts by hackers to pressure medical organizations into paying ransoms.

The involvement of federal investigators underscores the broader security implications of attacks targeting healthcare infrastructure, where stolen information can include both highly sensitive personal identifiers and detailed medical records.

Oracle declined to comment on the newly disclosed figures, while the Texas attorney general’s office did not respond to requests for comment referenced in the source material.

What Investors and Healthcare Organizations Should Watch Next

The disclosure significantly expands the known scale of the Oracle healthcare breach and raises questions about cybersecurity risks associated with legacy systems, particularly following large technology acquisitions.

For Oracle, attention will likely remain focused on how the company addresses affected customers, legacy infrastructure and the security of healthcare data. For healthcare organizations, the incident highlights the importance of understanding where sensitive patient information is stored and how older systems are integrated into modern cloud environments.

The full implications of the breach may become clearer as affected organizations and investigators provide additional information about the compromised data and the customers involved.