Hack: 6M Records for Sale Exfiltrated from Oracle Cloud Affecting 140k+ Tenants | Hacker News Reader

Hack: 6M Records for Sale Exfiltrated from Oracle Cloud Affecting 140k+ Tenants

cloudsek.com

39 pointsgnabgib17 comments

Oracle has the worst security posture I’ve ever seen. They are completely anti-bug bounty. I’ve reported multiple critical vulnerabilities as a customer and it was nightmare. They denied there being an issue until I developed working exploits. Then they took nearly a year to develop a fix. It amazes me how they haven’t had more breaches

They most likely have had many more breaches, just unknown or unreported.

they have a great legal team!

The original reporter (CloudSek) is doubling down in his claims and now they put some evidence that contradicts Oracle https://www.cloudsek.com/blog/part-2-validating-the-breach-o...

Oracle says it's not them.

> As further proof that they had access to Oracle Cloud servers, the threat actor shared this URL with BleepingComputer, showing an Internet Archive URL that indicates they uploaded a .txt file containing their ProtonMail email address to the login.us2.oraclecloud.com server.

Sure. But this somehow could have been faked or staged. Why not a direct link?

Are you suggesting the Internet Archive is vulnerable to being tricked into including arbitrary data in page crawls? Is there a known CVE? (Edit: Genuinely asking. That sounded adversarial.)

We don’t have a lot of info on how Oracle manages that part of its infrastructure. If they were able to upload a file to the server, that instance or build may have already been replaced by another deployment. Perhaps with or without that vulnerability. An IA snapshot could preserve the evidence beyond such events.

Lol Internet Archive if it's vulnerable there'll be a ton of misinformation campaigns around it

> On 21 March 2025, CloudSEK’s XVigil discovered a threat actor, "rose87168," selling 6M records exfiltrated from SSO and LDAP of Oracle Cloud. The data includes JKS files, encrypted SSO passwords, key files, and enterprise manager JPS keys.

That's bad

Oracle used their own unpatched product for over 10 years? Yikes.

So only organisations that have had an Oracle license audit are impacted?

I think this marks the end of Oracle.

Don't think so, nobody sane was buying Oracle for years and yet they are still operating

And no doubt making boat loads of cash

They’ve taken the IBM model. Sit on patents and lawyers and die a slow death. Innovation be damned.

Not if you run an Oracle DB in the cloud it isn't!

Reply on news.ycombinator.com