ClosedHighNo fix needed
Oracle Cloud login servers breached: ~6M SSO/LDAP records offered for sale
Oracle Cloud Classic (Gen 1) login/IDM servers
A hacker using the name rose87168 claimed in March 2025 to have stolen about 6 million SSO and LDAP records from Oracle Cloud login servers. Oracle first denied an OCI breach, then told customers privately that two obsolete servers (reportedly Oracle Cloud Classic / Gen 1) were accessed, exposing usernames and hashed or encrypted passwords.
Why this severity: Cloud identity data breach; vendor initially denied it
- Started
- Mar 21, 2025
- Closed
- Apr 8, 2025
Affected
- n/a
Fixed in
No fixed release yet
Timeline2
News & write-ups4
- Oracle says 'obsolete servers' hacked, denies cloud breachBleepingComputer
- Oracle privately confirms Cloud breach to customersBleepingComputer
- Oracle tells customers its public cloud was compromisedThe Register · Apr 8, 2025
- Oracle admits breach of 'obsolete servers,' denies main cloud platform affectedCSO Online
Notes & caveats
Claim date (Mar 21) approximate; access reportedly began in January 2025.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
