Oracle
Disclosed Mar 21, 2025Unverified
Hacker steals Oracle Cloud SSO login data; Oracle blames obsolete servers
A threat actor claimed to have stolen 6 million records from Oracle Cloud federated SSO login servers affecting 140,621 tenant domains; Oracle denied a cloud breach but later told customers a hacker accessed two obsolete servers and published user names, and customers confirmed samples were valid.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Mar 21, 2025 |
| Attack | Hacking |
| Data exposed | EmailsCredentials and tokensPasswords |
| Sector | Tech · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
Sources
Notices filed
Other breaches at Oracle
Clop exploits Oracle E-Business Suite zero-day to steal data from dozensSupply chain exposed employment records, financial details, internal documents, Social Security numbers and names.Supply chainTechUSOct 2, 2025Hacker steals patient data from legacy Oracle Health (Cerner) serversHacking exposed health records and names.HackingHealthcareUSUnverifiedMar 28, 2025
History of this record
First recordedby seedSource
First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.