Oracle Corp. recently informed its customers about a security breach where hackers accessed and stole old client login credentials. This incident marks the second cybersecurity issue the company has disclosed in just a month.
According to sources familiar with the situation, Oracle staff alerted some clients this week that the attacker managed to obtain usernames, passkeys, and encrypted passwords. The company is now working with the FBI and cybersecurity firm CrowdStrike Holdings Inc. to investigate the breach. It appears that the hacker sought an extortion payment from Oracle.
This breach is separate from another incident reported last month, which involved unauthorized access to patient data from healthcare providers using Oracle’s software. In that case, Oracle had already notified some users that hackers accessed company servers and copied sensitive patient information.
The recent breach involved what Oracle described as a "legacy environment," a system that has not been in use for eight years. While the company reassured clients that the stolen credentials pose limited risk, some reports indicate that the stolen data might include login information from as recently as 2024.
Researchers from Trustwave Holdings Inc. confirmed that the data being sold online was indeed extracted from Oracle. They described it as a valuable dataset that could allow hackers to launch phishing attacks and potentially compromise user accounts.
In a previous statement, Oracle denied that its cloud storage had been breached, stating that the published credentials were not linked to Oracle Cloud and that no customers experienced data loss. However, the recent developments suggest that the situation is more serious than initially thought.
As Oracle continues to address these security challenges, customers are left to navigate the implications of these breaches on their own data security.