Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oracle customers confirm data stolen in alleged cloud breach is valid

bleepingcomputer.com

Post reply on HN
Print view View original

71–80 of 85 posts

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#71

Post by comprev »

toomuchtodo wrote: post #29
fock wrote: post #16

Earlier quoted context omitted.

we pay millions to Oracle. We hit a bug and it took 6months for them to reproduce and acknowledge there is a bug. they now seem to be on the lookout for someone being able to produce a fix: sales and indian after-sales can't do that... curious! Oracle seems just a moneygrabbing shell company at this point and I suppose the whole hyperscaler-cloud is developing towards that point with the leaders of those corporations…

Why are you still on Oracle? (genuine question, no snark)

Because of architectural decisions made a very long time ago (finance industry) and the potential risk of migrating to another platform.

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#72

Post by m3047 »

ziddoap wrote: post #7

> BleepingComputer has confirmed with multiple companies that associated data samples shared by the threat actor are valid. > In addition to the data, rose87168 shared an Archive.org URL with BleepingComputer for a text file hosted on the "login.us2.oraclecloud.com" server that contained their email address. This file indicates that the threat actor could create files on Oracle's server, indicating an actual breach.…

This just in... /s

Seriously though, Sullivan lost his appeal. You should have read up on this.

https://www.courthousenews.com/wp-content/uploads/2025/03/us...

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#73

Post by tartoran »

comprev wrote: post #71
toomuchtodo wrote: post #29

Earlier quoted context omitted.

Why are you still on Oracle? (genuine question, no snark)

Because of architectural decisions made a very long time ago (finance industry) and the potential risk of migrating to another platform.

It seems like an even bigger risk to not migrate.

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#74

Post by tartoran »

KaiserPro wrote: post #64

How long has oracle been denying it? three days?

Not sure how long it will take them to accept responsibility in this case or at least confirm but Oracle has always played the denying game, it looks like their favorite business practice.

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#75

Post by fock »

toomuchtodo wrote: post #29
fock wrote: post #16

Earlier quoted context omitted.

we pay millions to Oracle. We hit a bug and it took 6months for them to reproduce and acknowledge there is a bug. they now seem to be on the lookout for someone being able to produce a fix: sales and indian after-sales can't do that... curious! Oracle seems just a moneygrabbing shell company at this point and I suppose the whole hyperscaler-cloud is developing towards that point with the leaders of those corporations…

Why are you still on Oracle? (genuine question, no snark)

as others have mentioned

- institutional inertia - some weird consultant style people in key roles (this happens around cloudy stuff too) - the DBA-team - "we can't move everything!" - "we just migrated off solaris!"

however every new project with sane leadership seems to decide against oracle.

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#76

Post by znpy »

ziddoap wrote: post #10
znpy wrote: post #8

Earlier quoted context omitted.

> It's not like there are any real penalties to a breach. Not in the US maybe. In the EU under GDPR you have to disclose within 48h of you realizing (or made aware of) the breach. There are fines (at least) if you don't disclose it afaik. Oracle is gonna have issue with the EU, most likely.

Have their been any GDPR fines that amount to more than a rounding error of Oracle's revenue? Admittedly, I don't watch too closely, but from the ones I am aware of, I haven't seen any GDPR fines that made me finally think "wow, that might actually count as a punishment". (I would honestly be happy to learn of some!) There are disclosure laws in the US as well, but again, the fines are like a days worth of revenue. M…

> Have their been any GDPR fines that amount to more than a rounding error of Oracle's revenue?

Not yet, hopefully soon: under some circumstances GDPR fines can go up to 6% of gross earning (ebitda) iirc.

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#77

Post by inetknght »

overfeed wrote: post #70
inetknght wrote: post #66

Earlier quoted context omitted.

This isn't always a bad thing because microservice architecture isn't always the best solution.

Oracle extends the problem to the opposite end of microservices, by encouraging monolith DB consolidation, with unrelated monolith applications on the same db cluster for purely budgetary reasons.

> unrelated monolith applications on the same db cluster

If your "db cluster" is split into containers on one VM as you would do in any other cloud (because VMs are expensive), then you would have the same problem.

> encouraging monolith DB consolidation

Does it? I don't think so. I've worked with Oracle's stuff and the only real difference between Oracle Cloud and other clouds is that Oracle cloud is more expensive overall. There's nothing stopping you from running virtual machines and kubernetes in the same way you'd run it in any other cloud.

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#78

Post by fulafel »

overfeed wrote: post #70
inetknght wrote: post #66

Earlier quoted context omitted.

This isn't always a bad thing because microservice architecture isn't always the best solution.

Oracle extends the problem to the opposite end of microservices, by encouraging monolith DB consolidation, with unrelated monolith applications on the same db cluster for purely budgetary reasons.

Yep. And then when the DBs are already on the same servers, when there's a need to connect previously unrelated apps to some master data, a shortcut presents itself. The DBA thinks: After all, why not? Why shouldn't I take it?

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#79

Post by fulafel »

cess11 wrote: post #61
fulafel wrote: post #55

Earlier quoted context omitted.

It's possible it has redeeming features but seems more common to be just legacy. Multiple apps accessing the same DB leading to a gridlock from migration POV. (Plus career oracle DBAs etc in the org). As Oracle is so expensive it skews the architecture decisions towards multiple apps accessing the same DB.

If you handle large amounts of geographical data you'll need to invest quite a bit to move to Postgres. It's possible but you're going to need to touch a lot of existing code and figure out new performance characteristics and so on. A lot of it will be hard for an average organisation, not because it's very sophisticated and complex but because it will be large amounts of boring rote work that many developers don't s…

PostGIS seems leaps better to me (like the PG DX in other aspects). Eg in Oracle you don't have 2d points. Adding a geo index can fail in the middle and leave the table in a unusable state that requires DBA magic to untangle. Etc.

This is just on top of the general technical inferiority (eg there are no transactional schema changes, so you don't get the safe go/no-go in those when applying those as part of app deploys with a migration tool)

Post reply on HN