Despite Oracle denying a breach of its Oracle Cloud federated SSO login servers and the theft of account data for 6 million people, BleepingComputer has confirmed with multiple companies that associated data samples shared by the threat actor are valid. Last week, a person named ‘rose87168’ claimed to have breached Oracle Cloud servers and began selling the alleged authentication data and encrypted passwords of 6 million users. The threat actor also said that stolen SSO and LDAP passwords could be decrypted using the info in the stolen files and offered to share some of the data with anyone who could help recover them. Another email thread shared with BleepingComputer shows an exchange between the threat actor and someone using a ProtonMail email address who claims to be from Oracle. In this email exchange, the threat actor says someone from Oracle using a @proton.me email address told them that "We received your emails. The threat actor released multiple text files consisting of a database, LDAP data, and a list of 140,621 domains of companies that were allegedly impacted by the breach. No Oracle Cloud customers experienced a breach or lost any data," the company told BleepingComputer last Friday. In addition to the data, rose87168 shared an Archive.org URL with BleepingComputer for a text file hosted on the "login.us2.oraclecloud.com" server that contained their email address. One email shows the threat actor contacting Oracle's security email (secalert_us@oracle.com) to report that they hacked the servers. This denial, however, contradicts findings from BleepingComputer, which received additional samples of the leaked data from the threat actor and contacted the associated companies. This file indicates that the threat actor could create files on Oracle's server, indicating an actual breach. The threat actor also shared emails with BleepingComputer, claiming to be part of an exchange between them and Oracle. The threat actor claimed that this vulnerability was used in the alleged breach of Oracle's servers.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 26 Mar 2025 20:25:18 +0000