BleepingComputer has also separately confirmed with multiple Oracle customers that samples of the leaked data (including associated LDAP display names, email addresses, given names, and other identifying information) received from the threat actor were valid after Oracle told BleepingComputer that "There has been no breach of Oracle Cloud. Since the incident surfaced in March, when a threat actor (rose87168) put up 6 million data records for sale on BreachForums, Oracle has consistently denied reports of an Oracle Cloud breach in statements shared with the press. However, while Oracle told customers that this was non-sensitive old legacy data, the threat actor behind the breach shared data with BleepingComputer from the end of 2024 and later posted newer records from 2025 on BreachForums. Last month, BleepingComputer first reported that Oracle privately notified customers of another January breach at Oracle Health (a software-as-a-service (SaaS) company previously known as Cerner), which impacted patient data at multiple healthcare organizations and hospitals in the United States. Cybersecurity firm CybelAngel first revealed last week that Oracle told customers that an attacker deployed a web shell and additional malware on some of Oracle's Gen 1 (also known as Oracle Cloud Classic) servers as early as January 2025. Until the breach was detected in late February, the threat actor allegedly stole data from the Oracle Identity Manager (IDM) database, including user emails, hashed passwords, and usernames. "Oracle would like to state unequivocally that the Oracle Cloud—also known as Oracle Cloud Infrastructure or OCI—has NOT experienced a security breach," Oracle says in a customer notification shared with BleepingComputer. However, the company added that its Oracle Cloud servers were not compromised, and this incident did not impact customer data and cloud services. While this is admittedly true as it matches what Oracle is telling customers—that the breach impacted an older platform, Oracle Cloud Classic—this is merely wordsmithing, as cybersecurity expert Kevin Beaumont said. BleepingComputer has contacted Oracle to confirm whether these notices are legitimate and not sent by the threat actor or another third party, but we haven't received a response. No OCI service has been interrupted or compromised in any way," it added in emails sent from replies@oracle-mail.com, prompting customers to contact Oracle Support or their account manager if they have additional questions. Oracle has also yet to clarify if the breached servers are part of Oracle Cloud Classic or another platform.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 09 Apr 2025 19:15:23 +0000