Texas AG Claims 20 Million People Affected in Oracle Health Breach
Bloomberg reports the Texas attorney general's office says medical details, addresses and Social Security numbers were exposed in last year's Oracle Health data breach.
On Monday, Bloomberg reported that the Texas attorney general released information claiming that 20 million people's data was involved in last year's Oracle Health data breach. According to the attorney general's information, the exposed data included medical details, addresses, and Social Security numbers.
Oracle's medical clients include the Department of Defense and the Department of Veterans Affairs, according to Bloomberg. The attorney general's report did not specify how the data was accessed or which systems were involved.
In March 2025, Bleeping Computer reported evidence suggesting a data breach at Oracle Cloud, with a hacker using the name rose87168 releasing data apparently from Oracle's single sign-on system. Oracle denied any breach at the time, saying there had been no breach of Oracle Cloud and that published credentials were not for Oracle Cloud.
The following month, Bleeping Computer reported that Oracle had apparently confirmed a breach privately to some individuals, stating it became aware on or around February 20, 2025, of unauthorized access to Cerner data on an old legacy server not yet migrated to Oracle Cloud. According to rose87168, 6 million health records were exposed.
Last year, a Bloomberg source granted anonymity said the purpose of the hack was to hold data hostage and extract ransoms from U.S. medical providers. Oracle Health has not publicly responded to the Texas attorney general's claim.
Quick answers
How many people were affected in the Oracle Health data breach?
The Texas attorney general's released information claims 20 million people's data was involved, according to Bloomberg.
What data was exposed in the Oracle Health breach?
The attorney general's report stated the exposed data included medical details, addresses, and Social Security numbers.
When did the Oracle Health breach become known?
In March 2025, Bleeping Computer reported evidence suggesting a data breach at Oracle Cloud. Oracle later apparently confirmed a breach privately to some individuals, stating it became aware on or around February 20, 2025, of unauthorized access to Cerner data.