CloudSEK Presents Evidence Supporting Alleged Oracle Cloud Breach After Oracle Denial
Summary
CloudSEK says a 10,000-line sample and other evidence support claims that Oracle Cloud customer data was stolen, affecting 1,500+ organizations. Oracle denied a breach; CloudSEK recommends credential rotation and investigation.
Key points
- A BreachForums user claimed access to Oracle Cloud login servers and offered SSO and LDAP credentials, OAuth2 keys, and tenant data for sale.
- CloudSEK says evidence links login.us2[.]oraclecloud[.]com to production SSO and matches several customer domains in the alleged leaked data.
- CloudSEK's analysis of a 10,000-line sample found data associated with 1,500+ organizations, including personal email addresses and tenant identifiers.
- CloudSEK says independent researchers also verified the sample; Oracle categorically denied that Oracle Cloud was breached.
- Potential risks include unauthorized access, corporate espionage, extortion, and supply-chain compromise.
- CloudSEK advises affected organizations to rotate SSO and LDAP credentials, enforce MFA, investigate for unauthorized access, and monitor threat forums.
Article Details
- Victim Organization
- Oracle
- Victim Domain
- login.us2.oraclecloud.com
- Incident Type
- Alleged unauthorized access to Oracle Cloud production SSO infrastructure and exposure of customer data
- Disclosure Date
- 2025-03-21
- Data Types Exposed
- SSO credentials and passwords
- LDAP credentials and passwords
- OAuth2 keys
- Customer tenant information
- Personal email addresses
- JKS and key files
- Affected Records
- Approximately 6 million records, as reported in the article; a sample reportedly contained data from more than 1,500 organizations.
- Operational Impact
- The article reports exposure of authentication-related data and potential risks of unauthorized access, corporate espionage, and supply-chain compromise. It does not report confirmed service disruption.
- Ransom Or Extortion
- CloudSEK reports that the threat actor was coercing affected companies to pay for data removal; the article does not establish whether payments were made.
- Claim Status
- claimed
Threat Actors
Vendors
OneLoginOneLogin, an IAM solutions provider, has a knowledge-base article about Oracle Fusion, demonstrating how to configure OneLogin to provide SSO for Oracle Fusion using SAML.OracleOn 21st March 2025, a user named rose87168 posted on BreachForums, claiming access to Oracle Cloud’s login servers and offering sensitive data including SSO & LDAP credentials, OAuth2 keys, and customer tenant
Products
Oracle CloudOn 21st March 2025, a user named rose87168 posted on BreachForums, claiming access to Oracle Cloud’s login servers and offering sensitive data including SSO & LDAP credentials, OAuth2 keys, and customer tenantOracle FusionOneLogin, an IAM solutions provider, has a knowledge-base article about Oracle Fusion, demonstrating how to configure OneLogin to provide SSO for Oracle Fusion using SAML.