Oracle Cloud Security Breach Verified By News Outlet

Oracle denies a security breach involving its Cloud federated SSO login servers, but Lawrence Abrams writes in BleepingComputer that his publication has verified the legitimacy of leaked data samples with multiple companies.

A cyber gang calling itself ‘rose87168’ claims to have stolen authentication data for 6 million users. It has reportedly attempted to sell the information and claims that encrypted passwords can be decrypted.

Despite these claims, Oracle insists that it has not suffered a security breach, that the credentials are not linked to Oracle Cloud, and that no customer data was lost. It has refused to respond to any further questions about the incident.

The denial contradicts findings from BleepingComputer, which received additional samples of leaked data from the rose87168 group and contacted the associated companies. The threat actor also shared emails with BleepingComputer, claiming to be part of an exchange between them and Oracle.

The alleged breach involved leaked text files containing LDAP data and a list of over 140,000 company and government domains. The threat actor also shared an Archive.org URL with a text file hosted on Oracle’s servers, indicating they could create files on the system.

Representatives from companies that agreed to confirm the data under the promise of anonymity said the information was authentic. The companies stated that the associated LDAP display names, email addresses, given names, and other identifying information were correct and belonged to them.

 The incident underscores the risk of relying solely on cloud providers for security. Lawyers should advise their clients to assess third-party security measures, monitor privileged accounts, and ensure robust incident response plans to mitigate potential threats.