Oracle Health data breach exposes personal information of nearly 20 million patients

A major cybersecurity breach affecting Oracle Health exposed sensitive medical and personal data of nearly 20 million patients across as many as 80 US hospitals. The incident, disclosed by the Texas Attorney General in October 2026, stemmed from two unmigrated legacy Cerner servers accessed in early 2025. Exposed records included Social Security numbers, diagnoses, and lab results. Attackers demanded ransom payments from healthcare providers, prompting an FBI investigation.

Scope and scale of breach

• ▪An October 2, 2026 Texas Attorney General's office filing revealed an Oracle Corporation healthcare division breach compromised personal and medical information of nearly 20 million patients across the United States.
• ▪State disclosures indicated that the Oracle Health data breach affected 2,992,244 residents in Texas, 1,978,661 in Oregon, 283,903 in South Carolina, and 69,238 in Washington.
• ▪The Oracle Health legacy server security breach compromised patient information across as many as 80 hospitals in the United States.

Cause and infrastructure details

• ▪Oracle Health notified healthcare clients in March 2025 that unauthorized access to legacy system data occurred between January 22, 2025, and April 1, 2025.
• ▪Oracle Health stated that its active Oracle Cloud infrastructure was not compromised during the legacy server intrusion.
• ▪The Oracle Health breach originated from unauthorized access to two legacy Cerner Corporation servers that had not yet been migrated to Oracle Cloud infrastructure.

Federal agency responses

• ▪The FBI launched an investigation into the cyberattack targeting Oracle Health's legacy healthcare database infrastructure.
• ▪A Department of Veterans Affairs representative stated in 2025 that the agency's systems remained unaffected by the Oracle Health data breach.

Oracle stock Performance and insider trading

• ▪Oracle Corporation stock opened at $142.47 on October 6, 2026, trading substantially below its 52-week high of $322.54.
• ▪Rockland Trust Company reduced its Oracle stock position by 40% during the quarter, while Oracle company insiders sold 36,075 shares valued at $5.3 million over 90 days.

Debatable claims

• ▪Oracle's framing of the breach as restricted to legacy servers minimized the incident's severity
• ▪Withholding nationwide victim totals until state regulatory filings delayed necessary consumer protective measures
• ▪Oracle bears primary responsibility for the cybersecurity breach of unmigrated Cerner legacy servers
• ▪Regulators should mandate maximum timelines for securing legacy health data during corporate acquisitions