After finally admitting to the breach, a tech titan’s mishandled public responses now fuels multiple lawsuits and erodes inflated industry trust.
On 25 March 2025, CybersecAsia.net had reported that a cloud data breach involving 6m records from Oracle Cloud had been disputed by the latter firm despite strong anecdotal evidence and analyses by IT experts.
Weeks into the ensuing investigations, we have seen how the saga has unfolded.
On 10 Apr 2025, Techzine.eu had covered how Oracle has confirmed the data breach.
Here is a summary of the latest developments to date:
- Breach acknowledgment: By 7 April 2025, Oracle had finally admitted to a compromise in its public cloud, reversing earlier denials, after a hacker, “rose87168,” had initially claimed responsibility.
- Attack details: The intrusion had targeted two “obsolete” servers running unpatched Oracle Fusion Middleware, exploiting CVE-2021-35587, a known vulnerability from 2021.
- Data stolen: Approximately 6m records had been exfiltrated, including encrypted SSO/LDAP passwords, security keys, and tenant data, impacting over 140,000 tenants.
- Server neglect: The compromised servers, last updated in 2014, were still online as of February 2025, highlighting Oracle’s failure to patch critical systems.
- Ramifications:
- Legal fallout: A class-action lawsuit by a Michael Toikach is accusing Oracle of inadequate security, potentially costing clients time and money.
- Reputational damage: Delayed transparency eroded trust, drawing parallels to the SolarWinds attack.
- Security overhaul needed: Expert observers have noted that the serious breach underscores Oracle’s need for better patch management and system monitoring.
- Industry impact: Experts warn this could be a “watershed moment” for cloud security, urging third-party risk awareness.
The Oracle cloud breach saga, evolving from denial to admission, exposes critical vulnerabilities in even the most established tech giants. As more legal battles loom, and regulatory scrutiny intensifies, this monumental breach and negligence of good crises management basics underscores the urgent need for cloud customers’ proactive risk management and vigilance in third-party dependencies.
As cloud reliance grows, such wake-up calls demand that businesses and providers alike prioritize resilience to safeguard data in an ever-evolving threat landscape.
