5 Healthcare Vendor Breaches Each Hit Over 1 Million People

Five healthcare vendors have disclosed that breaches of their systems each affected more than 1 million people, and their reported totals add up to more than 30 million, according to Becker's Hospital Review. The incidents span the core of healthcare's technology stack: electronic health records, data management, artificial intelligence, and medical billing companies.

Oracle Health leads the group by a wide margin, with a breach affecting nearly 20 million people. Four of the five breaches occurred in 2025, with disclosures landing in 2026, a reminder that the gap between an intrusion and public notification often stretches into months.

The pattern is clear. Attackers increasingly target vendors rather than individual hospitals, because a single compromised platform can expose millions of patient records held by many provider clients at once. For health systems, that shifts the security question away from their own firewalls and toward the practices of every partner they hand data to. Vendor risk management, contract terms, and breach-notification timelines now carry real financial and reputational weight.