Oracle Health breach exposes data of nearly 20 million people
Oracle Corp. disclosed that a cyberattack on its Oracle Health unit compromised personal and medical information stored on legacy Cerner servers. The breach, which began on or after Jan 22 2025 and was discovered around Feb 20 2025, affected roughly 20 million individuals, including about 3 million Texas residents. The incident involves older Cerner systems acquired in 2022 for roughly $28 billion and has triggered multiple state breach filings and federal class‑action lawsuits.
Why it matters
The breach raises significant regulatory and legal exposure for Oracle, as the company faces HIPAA‑related investigations and proposed class‑action suits. The scale of the incident could increase compliance costs and damage Oracle’s reputation in the healthcare market, potentially affecting future contracts.
Key facts
- 1The breach affected about 20 million patients, up from an earlier estimate of 501. bankinfosecurity.com
- 2Approximately 3 million of the affected individuals reside in Texas. bankinfosecurity.com
- 3Oracle acquired Cerner in 2022 for about $28.3 billion. bankinfosecurity.com
- 4The intrusion began as early as Jan 22 2025 and was discovered around Feb 20 2025. the420.in
- 5State filings list 2,992,244 Texas victims, 283,000 in South Carolina, and 69,000 in Washington. the420.in
- 6The breach involved legacy Cerner servers that had not yet been migrated to Oracle Cloud. the420.in
Open questions
- Acquisition price is reported as $28 billion in one source and $28.3 billion in others.
- Initial victim estimate of 501 patients differs from the later 20 million figure.
Summary written by AlphAI from 7 of 7 sources. Not investment advice. Figures are as stated by the linked sources.