CyberSecurity news

FlagThis

Dissent@DataBreaches.Net //

Oracle Confirms Cloud Data Breach Impacting Customers

Oracle has confirmed a cloud data breach, issuing notifications to customers about a cybersecurity incident. The confirmation follows claims by a threat actor alleging possession of millions of data lines related to over 140,000 Oracle Cloud tenants, including sensitive Personally Identifiable Information (PII), along with corporate and financial data. The company states the breach involved what it described as "two obsolete servers," and maintains that its Oracle Cloud Infrastructure (OCI) was not compromised, and no OCI customer data was viewed or stolen. However, this incident has brought into question Oracle's communication strategy and the accuracy of its disclosures.

The company's initial response has sparked debate and criticism, with cybersecurity experts and customers expressing concern over potential inconsistencies in Oracle's narrative. While Oracle claims the issue stemmed from "obsolete servers," independent analyses and customer confirmations suggest that customer data may have been compromised, contradicting the company's initial denial of an OCI breach. The discrepancy between Oracle's statements and the emerging evidence has raised questions about transparency and the potential use of carefully chosen terminology to minimize the perceived impact of the incident.

The communication strategy has drawn specific criticism regarding Oracle's distinction between "Oracle Cloud" and "Oracle Cloud Classic." Experts, like Kevin Beaumont, have pointed out that this distinction allows Oracle to deny a breach of "Oracle Cloud" while acknowledging issues with "Oracle Classic," which is still part of Oracle's cloud services. This approach raises concerns about potential wordplay and its effects on customer trust and Oracle's reputation. The incident highlights the challenges companies face in maintaining transparency and trust during cybersecurity incidents, especially when sensitive customer data is at risk.

Share: bluesky twitterx--v2 facebook--v1 threads


References :
  • DataBreaches.Net: Oracle’s statement to customers is still raising questions about its disclosure and transparency
  • The DefendOps Diaries: Explore Oracle's security incident, its communication strategy, and the implications for customer trust and industry standards.
  • securityaffairs.com: Oracle confirms a cloud data breach, quietly informing customers while downplaying the impact of the security breach.
  • BleepingComputer: Oracle finally confirmed in email notifications sent to customers that a hacker stole and leaked credentials that were stolen from what it described as "two obsolete servers."
  • The Register - Security: Oracle says its cloud was in fact compromised
  • securityonline.info: Oracle Data Breach: Authenticity Confirmed Despite Denial
  • Cyber Security News: CyberPress on Oracle Confirms Breach
  • cyberinsider.com: Oracle Sends “Not a Breach†Notices to Customers Following Data Exposure
  • phishingtackle.com: Oracle Confirms Cloud Data Breach, Privately Alerts Affected Customers
  • Techzine Global: Oracle confirms data breach via outdated servers, denies cloud breach
  • The Register - Security: The Reg translates the letter in which Oracle kinda-sorta tells customers it was pwned
  • Phishing Tackle: Oracle Confirms Cloud Data Breach, Privately Alerts Affected Customers
  • securityonline.info: At the end of March, a hacker claimed to have breached Oracle’s cloud infrastructure, allegedly exfiltrating approximately six million records. These reportedly included sensitive materials such as Oracle Cloud customer security keys, encrypted credentials, and LDAP authentication data. The threat actor even published a sample of the data as proof. Oracle promptly denied the breach, […] The post appeared first on .
  • CyberInsider: Cybersecurity Insiders article about Oracle's sends the data exposure notices to customers
  • www.csoonline.com: Oracle admits breach of ‘obsolete servers,’ denies main cloud platform affected
Classification: