Best of 2025: Oracle Hack: From ‘Deny-Deny-Deny’ to ‘Oops-Oops-Oops’
None
<h5 style="text-align: center;"><strong>Larry’s PR angels desperately dance on the head of a pin.<a href="#sbbwis"><img decoding="async" class="alignright size-full" title="U.S. State Dept." src="https://securityboulevard.com/wp-content/uploads/2025/04/oracle-cloud-breach-redux-us-state-dept-pd-130x90.png" alt="Oracle executive chairman Larry Ellison" width="130" height="90"></a></strong></h5><p><strong>Oracle is now admitting that, yes, an Oracle cloud service <em>was</em> breached</strong>. This is, of course, despite <a title="Oracle Hack PR Drama: Deny, Deny, Deny — Despite Damning Data" href="https://securityboulevard.com/2025/03/oracle-cloud-breach-deny-richixbw/" target="_blank" rel="noopener">last week’s vehement</a><a title="Oracle Hack PR Drama: Deny, Deny, Deny — Despite Damning Data" href="https://securityboulevard.com/2025/03/oracle-cloud-breach-deny-richixbw/" target="_blank" rel="noopener"> denials</a>.<br><!--br--><br>In today’s <a href="https://securityboulevard.com/tag/sb-blogwatch/" target="_blank" rel="noopener">SB Blogwatch</a>, we see man tic. <a title="Richi Jennings" href="https://www.richi.uk/" target="_blank" rel="noopener">Your humble blogwatcher</a> curated these bloggy bits for your entertainment. Not to mention: <i>Happy Birthday</i>.<br><!--br--><br>Editor Note: Oracle has now officially acknowledged the breach involved stolen credentials from two obsolete servers but maintains that no data was stolen.</p><h2>Classic ‘Wordplay’</h2><p id="sbbw1"><strong>What’s the craic?</strong> Jake Bleiberg and Julie Zhu report: <a title="read the full text" href="https://www.bloomberg.com/news/articles/2025-04-02/oracle-tells-clients-of-second-recent-hack-log-in-data-stolen" target="_blank" rel="ugc noopener">Oracle Tells Clients of Second Recent Hack, Log-In Data Stolen</a></p><p style="padding-left: 40px;"><strong>“<tt>Log-in credentials from as recently as 2024</tt>”</strong><br>Oracle Corp. has told customers that a hacker broke into a computer system and stole old client log-in credentials, according to two people familiar with the matter. … The attacker gained access to usernames, passkeys and encrypted passwords, according to the people, who spoke on condition that they not be identified.<br>…<br>Information about the stolen credentials started coming out last [week], when … Oracle denied that its cloud storage product had been hacked: … “There has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data.” [But] this week, Oracle staff acknowledged to some clients that an attacker had gotten into what the company called a “legacy environment,” according to the people. [One] person familiar with the breach said the stolen data included Oracle customer log-in credentials from as recently as 2024.<br><!-----------------------------------------------------------------------------></p><p id="sbbw2"><strong>This feels odd. More detail please?</strong> Sergiu Gatlan digs in: <a title="read the full text" href="https://www.bleepingcomputer.com/news/security/oracle-privately-confirms-cloud-breach-to-customers/" target="_blank" rel="ugc noopener">Oracle privately confirms Cloud breach to customers</a></p><p style="padding-left: 40px;"><strong>“<tt>Oracle has consistently denied reports of a breach</tt>”</strong><br>Oracle has finally acknowledged to some customers that attackers have stolen old client credentials after breaching a “legacy environment.” … However, while Oracle told clients this is old legacy data that is not sensitive, the threat actor behind the attack has … posted newer records from 2025.<br>…<br>Cybersecurity firm CybelAngel first revealed that Oracle told clients that an attacker who gained access to … Oracle Cloud Classic servers as early as January 2025. … The attacker allegedly exfiltrated data from the Oracle Identity Manager (IDM) database, including user emails, hashed passwords, and usernames.<br>…<br>Oracle has consistently denied reports of a breach in Oracle Cloud in statements shared with the press since the incident surfaced. … An Oracle spokesperson was not immediately available for comment.<br><!-----------------------------------------------------------------------------></p><p id="sbbw6"><strong>Not available? Or not willing?</strong> <a title="read the full text" href="https://arstechnica.com/security/2025/03/oracle-is-mum-on-reports-it-has-experienced-2-separate-data-breaches/" target="_blank" rel="ugc noopener">Dan Goodin</a> goes with the latter:</p><p style="padding-left: 40px;">When I asked Oracle for comment, a spokesperson asked if they could provide a statement that couldn’t be attributed to Oracle in any way. After I declined, the spokesperson said Oracle would have no comment.<br><!-----------------------------------------------------------------------------></p><p id="sbbw3"><strong>No doubt Dan’s now on a permanent PR blocklist.</strong> CybelAngel’s Todd Carroll isn’t in favor either: <a title="read the full text" href="https://cybelangel.com/oracle-data-leak-breaking-news/" target="_blank" rel="ugc noopener">Our Investigation of the Oracle Cloud Data Leak</a></p><p style="padding-left: 40px;"><strong>“<tt>Payment of 20 million USD</tt>”</strong><br>Oracle has allegedly determined an attacker was in the shared identity service as early as January 2025. This exposure was facilitated via a 2020 Java exploit and the hacker was able to install a webshell along with malware [that] specifically targeted the Oracle IDM database.<br>…<br>Oracle allegedly became aware of a potential breach in late February and investigated this issue internally. … The requested ransom is a payment of 20 million USD.<br><!-----------------------------------------------------------------------------></p><p id="sbbw4"><strong>Ouch.</strong> Kevin Beaumont has harsh words for ORCL: <a title="read the full text" href="https://doublepulsar.com/oracle-attempt-to-hide-serious-cybersecurity-incident-from-customers-in-oracle-saas-service-9231c8daff4a" target="_blank" rel="ugc noopener">Oracle attempt to hide serious cybersecurity incident</a></p><p style="padding-left: 40px;"><strong>“<tt>Step up, Oracle</tt>”</strong><br>It has now become 100% clear … there has been cybersecurity incident at Oracle, involving systems which processed customer data. … Multiple Oracle cloud customers have reached out to me to say Oracle have now confirmed a breach of their services. [Oracle is] only doing so verbally, they will not write anything down.<br>…<br>Oracle are attempting to wordsmith statements around Oracle Cloud and use very specific words to avoid responsibility. This is not okay. … Oracle rebadged old Oracle Cloud services to be Oracle Classic. Oracle Classic has the security incident. Oracle are denying it’s on “Oracle Cloud” by using this … wordplay.<br>…<br>This is a matter of trust and responsibility. Step up, Oracle — or customers should start stepping off.<br><!-----------------------------------------------------------------------------></p><p id="sbbw5"><strong>What have Larry’s lot got to hide?</strong> <a title="read the full text" href="https://news.ycombinator.com/item?id=43536732" target="_blank" rel="ugc noopener">nerdjon</a> tries to figure it out:</p><p style="padding-left: 40px;">Whether we like it or not, security incidents have become such commonplace in the last several years that if they just admitted to it, this entire story would have likely been shrugged off and mostly forgotten about. … Instead it is turning into an entire <i>thing</i> that just seems to be getting deeper and deeper.<br>…<br>Seriously, if I can’t trust that I am going to actually be told and not lied to when there is a security incident, … why would I chose to work with a company? What is Oracle’s end goal here? … Trying to think about how this is anything except them just straight up lying.<br><!-----------------------------------------------------------------------------></p><p id="sbbw7"><strong>Are you pondering what I’m pondering?</strong> <a title="read the full text" href="https://forums.theregister.com/forum/all/2025/04/02/oracle_breach_disaster_planning/#c_5048127" target="_blank" rel="ugc noopener">Doctor Syntax</a> seems to be:</p><p style="padding-left: 40px;">Googling “Streisand Effect” might be an education. … Do they learn nothing in PR school?<br><!-----------------------------------------------------------------------------></p><p id="sbbw8"><strong>PR shens aside, let’s get back to the real issue.</strong> It’s “criminal negligence,” according to <a title="read the full text" href="https://developers.slashdot.org/comments.pl?sid=23655181&cid=65279457" target="_blank" rel="ugc noopener">kurkosdr</a></p><p style="padding-left: 40px;">Oracle didn’t update Oracle Access Manager in their Oracle Cloud Classic product, leaving a known vulnerability from 2021 unpatched, which was then exploited by a third party. Imagine taking 4 years to update your own software running on your own service.<br><!-----------------------------------------------------------------------------></p><p id="sbbw9"><strong>What’ll this do to Oracle’s reputation?</strong> If <a title="read the full text" href="https://arstechnica.com/civis/threads/oracle-is-mum-on-reports-it-has-experienced-2-separate-data-breaches.1506496/post-43622153" target="_blank" rel="ugc noopener">Brendan McKinley</a>’s opinion is anything to go by, it couldn’t get much worse:</p><p style="padding-left: 40px;">Remember the old tech industry proverb: <i>Oracle doesn’t have customers, they have hostages</i>. … Why any corporation would voluntarily rely on them for cloud services is beyond me.<br><!-----------------------------------------------------------------------------></p><p id="sbbw12"><strong>Meanwhile,</strong> <a title="read the full text" href="https://www.reddit.com/r/cybersecurity/comments/1jqlwq1/comment/mlakfly/" target="_blank" rel="ugc noopener">u/Feisty_Donkey_5249</a> muses on marketing:</p><p style="padding-left: 40px;">“Unbreakable,” to quote their advertising.<br><!-----------------------------------------------------------------------------></p><p><b><a title="And Finally" href="https://www.youtube.com/watch?v=3OQUWj8uKx8&list=PL9zSC5i495YMjIuJjxToNGU8Ve7Gd5Rvj" target="_blank" rel="noopener">This is … something</a></b><script src="https://scripts.withcabin.com/hello.js" async="" defer></script><!-- zero-cookie analytics privacy: https://withcabin.com/privacy/securityboulevard.com --></p><p><a href="https://www.youtube.com/playlist?list=PL9zSC5i495YMjIuJjxToNGU8Ve7Gd5Rvj" target="_blank" rel="noopener">Previously in <em>And Finally</em></a></p><hr><p><em>You have been reading <i>SB Blogwatch</i> by <a href="https://www.richi.uk/" target="_blank" rel="noopener">Richi Jennings</a>. Richi curates the best bloggy bits, finest forums, and weirdest websites—so you don’t have to. Hate mail may be directed to <a href="https://twitter.com/richi" target="_blank" rel="ugc noopener">@RiCHi</a>, <a href="https://threads.net/@richij" target="_blank" rel="ugc noopener">@richij</a>, <a href="https://vmst.io/deck/@richi" target="_blank" rel="ugc noopener">@<span class="__cf_email__" data-cfemail="c7b5aea4afae87b1aab4b3e9aea8">[email protected]</span></a>, <a href="https://bsky.app/profile/richi.bsky.social" target="_blank" rel="ugc noopener">@richi.bsky.social</a> or <a href="/cdn-cgi/l/email-protection#8bf8e9e9fccbf9e2e8e3e2a5e8e4a5fee0b4f8fee9e1eee8ffb6a6f8e9e9fca6"><span class="__cf_email__" data-cfemail="067564647146746f656e6f28736d">[email protected]</span></a>. Ask your doctor before reading. Your mileage may vary. Past performance is no guarantee of future results. Do not stare into laser with remaining eye. E&OE. 30.</em></p><p>Image sauce: <a href="https://www.flickr.com/photos/statephotos/49390232303" target="_blank" rel="noopener" name="sbbwis">U.S. State Department</a></p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2025/12/oracle-hack-from-deny-deny-deny-to-oops-oops-oops-2/" data-a2a-title="Best of 2025: Oracle Hack: From ‘Deny-Deny-Deny’ to ‘Oops-Oops-Oops’"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2025%2F12%2Foracle-hack-from-deny-deny-deny-to-oops-oops-oops-2%2F&linkname=Best%20of%202025%3A%20Oracle%20Hack%3A%20From%20%E2%80%98Deny-Deny-Deny%E2%80%99%20to%20%E2%80%98Oops-Oops-Oops%E2%80%99" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2025%2F12%2Foracle-hack-from-deny-deny-deny-to-oops-oops-oops-2%2F&linkname=Best%20of%202025%3A%20Oracle%20Hack%3A%20From%20%E2%80%98Deny-Deny-Deny%E2%80%99%20to%20%E2%80%98Oops-Oops-Oops%E2%80%99" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2025%2F12%2Foracle-hack-from-deny-deny-deny-to-oops-oops-oops-2%2F&linkname=Best%20of%202025%3A%20Oracle%20Hack%3A%20From%20%E2%80%98Deny-Deny-Deny%E2%80%99%20to%20%E2%80%98Oops-Oops-Oops%E2%80%99" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2025%2F12%2Foracle-hack-from-deny-deny-deny-to-oops-oops-oops-2%2F&linkname=Best%20of%202025%3A%20Oracle%20Hack%3A%20From%20%E2%80%98Deny-Deny-Deny%E2%80%99%20to%20%E2%80%98Oops-Oops-Oops%E2%80%99" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2025%2F12%2Foracle-hack-from-deny-deny-deny-to-oops-oops-oops-2%2F&linkname=Best%20of%202025%3A%20Oracle%20Hack%3A%20From%20%E2%80%98Deny-Deny-Deny%E2%80%99%20to%20%E2%80%98Oops-Oops-Oops%E2%80%99" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div>