# Oracle Cloud login servers breached: ~6M SSO/LDAP records offered for sale · pwn.watch

> A hacker using the name rose87168 claimed in March 2025 to have stolen about 6 million SSO and LDAP records from Oracle Cloud login servers. Oracle first denied an OCI breach, then told customers privately that two obsolete servers (reportedly Oracle Cloud Classic / Gen 1) were accessed, exposing usernames and hashed or encrypted passwords.

Page: https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025 · generated 2026-10-22T22:54:30.229Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: Oracle Cloud Classic (Gen 1) login/IDM servers
- Started: 2025-03-21 · closed: 2025-04-08
- Affected: n/a

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025/feed.xml
- JSON Feed: https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025.json
- This file: https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025/llms.txt

## Updates (newest first)
- 2025-04-08: Reports that Oracle privately confirmed the breach to customers (https://www.theregister.com/off-prem/2025/04/08/oracle-tells-customers-its-public-cloud-was-compromised/431082)
- 2025-03-21: rose87168 claims theft of ~6M records; Oracle denies an Oracle Cloud breach (https://www.bleepingcomputer.com/news/security/oracle-says-obsolete-servers-hacked-denies-cloud-breach/)

## Fix brief
# Security brief: Oracle Cloud login servers breached: ~6M SSO/LDAP records offered for sale

Source: https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025 · status: closed (closed Apr 8, 2025) · severity: high · updated Apr 8, 2025

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
A hacker using the name rose87168 claimed in March 2025 to have stolen about 6 million SSO and LDAP records from Oracle Cloud login servers. Oracle first denied an OCI breach, then told customers privately that two obsolete servers (reportedly Oracle Cloud Classic / Gen 1) were accessed, exposing usernames and hashed or encrypted passwords.

Severity detail: Cloud identity data breach; vendor initially denied it

- Product: Oracle Cloud Classic (Gen 1) login/IDM servers

## Affected versions
- n/a

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Apr 8, 2025: Reports that Oracle privately confirmed the breach to customers
- Mar 21, 2025: rose87168 claims theft of ~6M records; Oracle denies an Oracle Cloud breach

## Write-ups & news
- [Oracle says 'obsolete servers' hacked, denies cloud breach](https://www.bleepingcomputer.com/news/security/oracle-says-obsolete-servers-hacked-denies-cloud-breach/)
- [Oracle privately confirms Cloud breach to customers](https://www.bleepingcomputer.com/news/security/oracle-privately-confirms-cloud-breach-to-customers/)
- [Oracle tells customers its public cloud was compromised](https://www.theregister.com/off-prem/2025/04/08/oracle-tells-customers-its-public-cloud-was-compromised/431082)
- [Oracle admits breach of 'obsolete servers,' denies main cloud platform affected](https://www.csoonline.com/article/3959636/oracle-admits-breach-of-obsolete-servers-denies-main-cloud-platform-affected.html)

## Caveats
Claim date (Mar 21) approximate; access reportedly began in January 2025.

---
Machine-readable: https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.