Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oracle customers confirm data stolen in alleged cloud breach is valid

bleepingcomputer.com

Post reply on HN
Print view View original

1–10 of 85 posts

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#4

Post by sidewndr46 »

greenchair wrote: post #3
2thumbsup wrote: post #2

Alone the fact that Oracle was hosting their login gateway on a product with a known vulnerability from 2021 with a CVSS score of 9.8 is quite disturbing.

hey at least they use their own product!

It appears they took dogfooding a little too literally

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#6

Post by pram »

2thumbsup wrote: post #2

Alone the fact that Oracle was hosting their login gateway on a product with a known vulnerability from 2021 with a CVSS score of 9.8 is quite disturbing.

Fun fact: Oracle has like 6+ LDAP/directory products, OAM is just one. Theres ODS, OIM, OID, OUD, OVD, NIS leftovers from Sun, and probably more honestly

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#7

Post by ziddoap »

>BleepingComputer has confirmed with multiple companies that associated data samples shared by the threat actor are valid.

>In addition to the data, rose87168 shared an Archive.org URL with BleepingComputer for a text file hosted on the "login.us2.oraclecloud.com" server that contained their email address. This file indicates that the threat actor could create files on Oracle's server, indicating an actual breach.

Oracle probably should have just admitted the validity up front.

It's not like there are any real penalties to a breach. Lying about it is probably a worse PR hit than the breach itself.

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#8

Post by znpy »

ziddoap wrote: post #7

> BleepingComputer has confirmed with multiple companies that associated data samples shared by the threat actor are valid. > In addition to the data, rose87168 shared an Archive.org URL with BleepingComputer for a text file hosted on the "login.us2.oraclecloud.com" server that contained their email address. This file indicates that the threat actor could create files on Oracle's server, indicating an actual breach.…

> It's not like there are any real penalties to a breach.

Not in the US maybe. In the EU under GDPR you have to disclose within 48h of you realizing (or made aware of) the breach.

There are fines (at least) if you don't disclose it afaik.

Oracle is gonna have issue with the EU, most likely.

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#10

Post by ziddoap »

znpy wrote: post #8
ziddoap wrote: post #7

> BleepingComputer has confirmed with multiple companies that associated data samples shared by the threat actor are valid. > In addition to the data, rose87168 shared an Archive.org URL with BleepingComputer for a text file hosted on the "login.us2.oraclecloud.com" server that contained their email address. This file indicates that the threat actor could create files on Oracle's server, indicating an actual breach.…

> It's not like there are any real penalties to a breach. Not in the US maybe. In the EU under GDPR you have to disclose within 48h of you realizing (or made aware of) the breach. There are fines (at least) if you don't disclose it afaik. Oracle is gonna have issue with the EU, most likely.

Have their been any GDPR fines that amount to more than a rounding error of Oracle's revenue? Admittedly, I don't watch too closely, but from the ones I am aware of, I haven't seen any GDPR fines that made me finally think "wow, that might actually count as a punishment". (I would honestly be happy to learn of some!)

There are disclosure laws in the US as well, but again, the fines are like a days worth of revenue. Maybe the breached company has to provide a year of credit monitoring for the affected persons, if lucky.

Post reply on HN