https://pwn.watch/t/oracle-cloud Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Tue, 08 Apr 2025 00:00:00 GMT https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025 https://pwn.watch/i/oracle-cloud-classic-login-breach-march-2025 Tue, 08 Apr 2025 00:00:00 GMT high <p>A hacker using the name rose87168 claimed in March 2025 to have stolen about 6 million SSO and LDAP records from Oracle Cloud login servers. Oracle first denied an OCI breach, then told customers privately that two obsolete servers (reportedly Oracle Cloud Classic / Gen 1) were accessed, exposing usernames and hashed or encrypted passwords.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2025-04-08: Reports that Oracle privately confirmed the breach to customers (<a href="https://www.theregister.com/off-prem/2025/04/08/oracle-tells-customers-its-public-cloud-was-compromised/431082">source</a>)</li><li>2025-03-21: rose87168 claims theft of ~6M records; Oracle denies an Oracle Cloud breach (<a href="https://www.bleepingcomputer.com/news/security/oracle-says-obsolete-servers-hacked-denies-cloud-breach/">source</a>)</li></ul>