Texas AG Reveals 20 Million Records in Oracle Health Breach

The Texas Attorney General has disclosed that 20 million individuals had their data exposed in a cybersecurity incident affecting Oracle Health. This figure significantly exceeds previous estimates and follows a timeline of conflicting reports regarding the scope of the compromise.

Scale of Data Exposure

Bloomberg reported on Monday that the state’s top law enforcement official released information detailing the magnitude of the leak. The exposed records contained sensitive medical details, physical addresses, and Social Security numbers. This revelation comes after initial claims by a hacker suggested only 6 million health records were involved.

Initial Denials and Private Confirmations

Last March, Bleeping Computer covered allegations that an individual using the handle rose87168 was publishing data extracted from Oracle’s single sign-on system. At that time, Oracle issued a statement denying any breach of its cloud infrastructure. The company asserted that published credentials did not belong to Oracle Cloud customers and that no client data had been lost.

By April, however, Bleeping Computer learned that Oracle had privately acknowledged a security event to affected parties. In communications to some individuals, the company stated it became aware of unauthorized access to Cerner data on or around February 20, 2025. Oracle specified that the compromised information resided on an old legacy server that had not yet been migrated to the Oracle Cloud environment. This distinction may explain the company’s earlier public stance that its primary cloud services remained secure.

Criminal Intent and Client Impact

A source speaking to Bloomberg last year, who requested anonymity, indicated that the hack aimed to hold data hostage for ransom payments from U.S. medical providers. Oracle’s healthcare sector clients include major government entities such as the Department of Defense and the Department of Veterans Affairs, according to Bloomberg.

Gizmodo contacted Oracle to request a statement regarding these latest developments. Updates will be provided if the company responds.