Oracle Confirms Another Major Data Breach: User Credentials Compromised
In a troubling development for Oracle Corp. (NYSE:ORCL), the tech giant has confirmed that a significant data breach has occurred, resulting in the theft of sensitive client login information. According to a report from Reuters, the breach marks the second such cybersecurity incident the company has disclosed within a single month, raising significant concerns among stakeholders and customers alike.The breach, which was reportedly perpetrated by an unidentified hacker, has compromised a range of sensitive information, including usernames, passwords, and even encrypted passwords. Insiders with knowledge of the situation informed Reuters that while the data was drawn from an older system that Oracle had not utilized for over eight years, it still poses a risk, as some of the stolen log-in credentials date back to as recently as 2024. This revelation further complicates Oracle's security narrative and raises questions about the effectiveness of their data protection measures.Compounding the issues, this latest data breach is distinct from another significant cybersecurity incident involving Oracle's servers that occurred at the end of March. In that earlier breach, hackers gained access to a trove of sensitive health data, including patient records, which were subsequently transferred to a remote location. At that time, Oracle faced sharp criticism for its lack of transparency; the company failed to alert affected parties for several weeks, which many viewed as unacceptable.In the recent breach, the hacker reportedly attempted to monetize the stolen data by offering it for sale online, alongside demands for an extortion payment from Oracle. Initially, Oracle denied the occurrence of this latest breach, asserting that no Oracle Cloud customers had experienced data loss. The company issued a statement to customers rejecting the claims of a breach. However, this stance was quickly undermined when researchers from Trustwave Holdings, a private security firm, validated the authenticity of the stolen data. Karl Sigler, a senior security research manager at Trustwave, described the compromised information as a 'rich dataset' that could serve as a basis for phishing emails or account takeovers.As the investigation unfolds, it appears that both the FBI and cybersecurity firm CrowdStrike Holdings (NASDAQ:CRWD) are involved in probing the incident. However, both entities have so far declined to comment publicly on the matter, leaving stakeholders in the dark. Although Oracle has not yet issued a formal public statement regarding the breach, sources revealed that internally, the company has acknowledged the hacking incident. With these two breaches occurring in such close succession, questions surrounding Oracleâs cybersecurity protocols and incident response strategies are likely to intensify in the coming weeks, prompting clients to reassess their trust in the companyâs data protection capabilities.
