Oracle Cloud denies claims of server intrusion

Oracle has straight up denied claims by a miscreant that its public cloud offering has been compromised and information stolen. A crook late last week advertised on an online cyber-crime forum what was alleged to be Oracle Cloud customer security keys and other sensitive data swiped from the IT giant. This material was said to have been obtained by the miscreant from at least one of the cloud provider's single-sign-on (SSO) login servers by exploiting a security vulnerability. Oracle says that's not true. "There has been no breach of Oracle Cloud," a spokesperson told The Register on Friday. "The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data." Meanwhile, as noted by the guys at Bleeping, the miscreant boasted of creating a text file on an Oracle Cloud login server, specifically login.us2.oraclecloud.com, captured here by the Internet Archive's Wayback Machine in early March, as proof that systems were compromised. That file contains simply the email address of the person attempting to sell what's said to be the stolen Oracle Cloud data. We've asked Oracle for further clarification or an explanation. It's claimed that information was exfiltrated from the EM2 as well as US2 login server. Samples of allegedly stolen info were also shared by the would-be thief. Looking through the Wayback Machine, we can see that the US2 server was as recently as February 2025 running some form of Oracle Fusion Middleware 11G. ...