Oracle has firmly denied claims that its cloud infrastructure was breached following reports that a hacker is attempting to sell six million allegedly stolen data records. The company insists that no Oracle Cloud customers have suffered a breach or data loss, refuting allegations by the threat actor known as “rose87168.”
“There has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data,” Oracle stated in response to inquiries from cybersecurity news outlet BleepingComputer.
The controversy began when rose87168 released multiple text files containing what they claimed to be a sample database, LDAP information, and a list of affected companies allegedly stolen from Oracle Cloud’s Single Sign-On (SSO) platform. To support their claims, the hacker shared an Internet Archive URL proving they uploaded a text file containing their ProtonMail email address to the login.us2.oraclecloud.com server. However, Oracle has not explained how this upload could have occurred without compromised systems.
Currently, rose87168 is offering the purported stolen data for an undisclosed price or in exchange for zero-day exploits on the BreachForums hacking forum. The hacker claims the data includes encrypted SSO passwords, Java Keystore (JKS) files, key files, and enterprise manager JPS keys. According to their statements, the stolen SSO passwords can be decrypted using additional files in their possession, while LDAP hashed passwords can allegedly be cracked.
In an apparent attempt at extortion, the hacker has also offered companies the option to pay to remove their employees’ data before the entire database is sold. Additionally, they are seeking assistance from others in decrypting the SSO passwords and cracking the LDAP credentials.
Rose87168 claims to have accessed Oracle Cloud servers approximately 40 days ago and alleges that they contacted the company after exfiltrating data from the US2 and EM2 cloud regions. According to the threat actor, they demanded a ransom of 100,000 Monero (XMR) in exchange for details on how they breached the system. They claim Oracle refused to pay after requesting the complete information to fix and patch the alleged vulnerability.
When questioned about how they gained access, the hacker stated that Oracle Cloud servers were running a vulnerable version of a software component with a publicly disclosed CVE flaw. However, they asserted that no public proof-of-concept (PoC) or exploit for this vulnerability exists.
