Five healthcare vendors disclosed in 2026 that breaches of their systems each affected more than 1 million people.
Their reported totals add up to more than 30 million, led by Oracle Health at nearly 20 million.
The incidents involve EHR, data management, AI and medical billing companies. Four of the breaches occurred in 2025, and one occurred in January 2026.
The list, ranked by number of people affected, reflects figures from Becker’s previous reporting:
- Oracle Health: Oracle Health’s 2025 breach compromised personal information belonging to nearly 20 million people, according to a Texas attorney general report cited by Bloomberg. Oracle Health had not previously disclosed how many patient records were affected. Oracle began alerting healthcare customers in March 2025 that attackers had accessed older Cerner servers containing data that had not yet been migrated to Oracle’s cloud. At least 29 hospitals and health systems were reportedly affected.
- Aesto Health: Aesto Health, which provides data migration, EHR exchange and legacy data archiving services, disclosed to HHS July 31 a breach affecting 9.54 million individuals. The company detected unauthorized activity within a portion of its Amazon Web Services infrastructure Dec. 18, 2025. It later determined that an unauthorized actor may have accessed or acquired data between Dec. 2 and Dec. 18, 2025. Information involved varied by individual and included medical information, Social Security numbers and health insurance information.
- Unlimited Technology Systems: Unlimited Technology Systems disclosed to HHS July 21 that a ransomware attack compromised data belonging to 3.8 million patients. The incident involved an Oct. 5-10, 2025, intrusion into a commercial data center hosting the vendor’s g4-Centricity for Vector platform. Exposed information may have included Social Security numbers, medical record numbers, diagnosis details and scanned identification documents.
- Xsolis: Healthcare AI company Xsolis, which provides utilization management and care coordination technology, disclosed a targeted phishing attack June 5 and told HHS that 1.4 million individuals were affected. The company said an unauthorized person accessed portions of its IT environment Jan. 20, 2026, and acquired a “limited number” of files. At least eight health systems were reportedly affected, including Rochester, Minn.-based Mayo Clinic, Seattle-based UW Medicine, Portland, Ore.-based Legacy Health and Urbana, Ill.-based Carle Health.
- MCBS: Medical billing and revenue cycle management company MCBS disclosed in a filing with HHS’ Office for Civil Rights that a network breach compromised personal and health information belonging to 1.26 million individuals. The intrusion occurred between Sept. 22 and Sept. 26, 2025. Compromised information varied by individual and included Social Security numbers, health insurance information and medical history, diagnosis and treatment information. The company’s notice identified seven covered-entity clients whose patients may have been affected.
The post 5 healthcare vendor breaches each affecting more than 1 million people appeared first on Becker's Hospital Review | Healthcare News & Analysis.