As further proof that they had access to Oracle Cloud servers, the threat actor shared this URL with BleepingComputer, showing an Internet Archive URL that indicates they uploaded a .txt file containing their ProtonMail email address to the login.us2.oraclecloud.com server. The threat actor told BleepingComputer they gained access to Oracle Cloud servers around 40 days ago and claimed to email the company after exfiltrating data from the US2 and EM2 cloud regions. Oracle denies it was breached after a threat actor claimed to be selling 6 million data records allegedly stolen from the company's Oracle Cloud federated SSO login servers. BleepingComputer contacted Oracle again to explain how the threat actor uploaded a text file containing their email address without access to Oracle Cloud servers. This statement comes after a threat actor known as rose87168 released multiple text files yesterday containing a sample database, LDAP information, and a list of the companies that they claimed were stolen from Oracle Clouds' SSO platform. They say the data (including encrypted SSO passwords, Java Keystore (JKS) files, key files, and enterprise manager JPS keys) was stolen after hacking into 'login.(region-name).oraclecloud. com' Oracle servers. rose87168 is now selling the allegedly stolen data from Oracle Cloud's SSO service for an undisclosed price or in exchange for zero-day exploits on the BreachForums hacking forum. No Oracle Cloud customers experienced a breach or lost any data," the company told BleepingComputer.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Fri, 21 Mar 2025 20:45:23 +0000