See Also - Oracle denies breach after hacker claims theft of 6 million data records
Company remains quiet since denying the attack, even after researchers conclude the breach is real
March 31, 2025 By Cal Jeffrey
In context: As sickening as it is to admit, data breaches have become a fact of life. We cannot go more than a month without one company or another announcing that a hacker or poor security hygiene left its clients exposed. As annoying as that is, it's even more irritating when the company tries to hide the intrusion.
Earlier this month, a threat actor going by Rose87168 claimed to have breached Oracle Cloud's federated SSO servers and exfiltrated around 6 million records, affecting over 144,000 Oracle clients. The hacker provided an internal customer list and threatened to sell the data unless clients paid to remove their data from the trove, which included single sign-on credentials, Lightweight Directory Access Protocol passwords, OAuth2 keys, tenant data, and more. Rose87168 has also solicited help from the hacking community to crack the hashed password in trade for some of the data.
A day after the threat actor posted a small sample of the data, Oracle told Bleeping Computer there was no breach of its cloud service. Upon Oracle's denial, Rose87168 began leaking "proof" to the media and security researchers. Security group Hudson Rock and experts at CloudSEK concluded that the data and credentials are legitimate.
