Industry
Five Healthcare Vendor Breaches Each Hit Over 1 Million People
Becker's Hospital Review reports that five healthcare vendors disclosed breaches in 2026 each affecting more than 1 million people, with combined totals exceeding 30 million individuals. Oracle Health led with nearly 20 million people affected after attackers accessed older Cerner servers, impacting at least 29 hospitals and health systems. Other affected vendors include Aesto Health (9.54 million), Unlimited Technology Systems (3.8 million via ransomware), Xsolis (1.4 million via phishing), and MCBS (1.26 million). Four breaches occurred in 2025 and one in January 2026, and exposed data included Social Security numbers, medical records, diagnoses and health insurance information.
Why it mattersHealth plans and state Medicaid agencies relying on these vendors for EHR exchange, utilization management, and billing services face downstream breach notification obligations and beneficiary data exposure risk affecting millions of enrollees.