According to information disclosed by the Texas Attorney General, Oracle Corporation's healthcare division suffered a cybersecurity breach last year, compromising the personal information of nearly 20 million individuals.

In a report released by the Texas Attorney General, the company disclosed that the hacker attack stole Social Security numbers, home addresses, and medical information of nearly 20 million people, including approximately 3 million Texas residents.

Oracle notified some customers in March 2025 about the cyberattack, stating that the breach occurred sometime after January 22, but the Texas-based company did not at that time disclose the number of affected patients' electronic health records.

Oracle declined to comment on Monday regarding the disclosed information, and the Texas Attorney General's Office also did not respond to requests for comment.

Oracle's healthcare customers include regional hospitals, clinics, the U.S. Department of Defense, and the Department of Veterans Affairs. It remains unclear what impact the breach has had on Oracle's federal government customers, though a Department of Veterans Affairs spokesperson said in March 2025 when the incident was disclosed that the department was not affected.

Texas healthcare providers Christus Health and Tri-City Medical Center in California stated that different patients were affected to varying degrees, and stolen information may include names, Social Security numbers, treating physicians, diagnoses, medications, laboratory reports, and other data. Both institutions said they are among numerous Oracle customers affected by this breach.

Media reported in March 2025 that the Federal Bureau of Investigation (FBI) had investigated the cyberattack, as well as related actions by hackers coercing healthcare companies to pay ransoms.

In its March 2025 notification, Oracle informed customers that attackers had breached legacy servers of the former Cerner Corporation. Oracle acquired Cerner for $28 billion in 2022. The notification stated that the data had not yet been migrated to Oracle's cloud storage services at the time.