Oracle
Disclosed Mar 21, 20251 year agoUnverified
Hacker steals Oracle Cloud SSO login data; Oracle blames obsolete servers
A threat actor claimed to have stolen 6 million records from Oracle Cloud federated SSO login servers affecting 140,621 tenant domains; Oracle denied a cloud breach but later told customers a hacker accessed two obsolete servers and published user names, and customers confirmed samples were valid.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Mar 21, 2025 |
| Attack | Hacking |
| Data exposed | Emails, Credentials and tokens, Passwords |
| Sector | Tech · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
Sources
| Source | |
|---|---|
| Oracle under fire for its handling of separate security incidentstechcrunch.com · News | News |
| Oracle customers confirm data stolen in alleged cloud breach is validbleepingcomputer.com · News | News |
| Oracle denies breach after hacker claims theft of 6 million data recordsbleepingcomputer.com · News | News |
| Oracle says obsolete servers hacked, denies cloud breachbleepingcomputer.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Mar 21, 2025 |
Other breaches at Oracle
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Clop exploits Oracle E-Business Suite zero-day to steal data from dozensOct 2, 202511 months agoSupply chain | Oct 2, 202511 months ago | Supply chain | Tech | Confirmed | Unknown |
| Hacker steals patient data from legacy Oracle Health (Cerner) serversMar 28, 20251 year agoHackingUnverified | Mar 28, 20251 year ago | Hacking | Healthcare | Unverified | Unknown |
History of this record
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.