Live data from Hacker News

Oracle customers confirm data stolen in alleged cloud breach is valid

bleepingcomputer.com

81–85 of 85 posts

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#81
post #79
post #61

Earlier quoted context omitted.

If you handle large amounts of geographical data you'll need to invest quite a bit to move to Postgres. It's possible but you're going to need to touch a lot of existing code and figure out new performance characteristics and so on. A lot of it will be hard for an average organisation, not because it's very sophisticated and complex but because it will be large amounts of boring rote work that many developers don't s…

PostGIS seems leaps better to me (like the PG DX in other aspects). Eg in Oracle you don't have 2d points. Adding a geo index can fail in the middle and leave the table in a unusable state that requires DBA magic to untangle. Etc. This is just on top of the general technical inferiority (eg there are no transactional schema changes, so you don't get the safe go/no-go in those when applying those as part of app deploy…

SDO_POINT(x, y, 0) or SDO_POINT(x, y, NULL) ought to do what you want. Index corruption can be a nasty problem on Postgres too.

You need to decide if and how to perform a rollback, similar to how you would define a down() procedure in migration files. A schema change might imply changes to data, and in that case you might turn off client writes, copy the table, change it, validate, do rename dance, turn on client writes again. If it doesn't it might be much cheaper to operate on a single copy. How does Postgres decide on such strategies automatically?

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#82
post #28

Earlier quoted context omitted.

If this breach receives a fine in the top 5 fines ever issued in the entire history of GDPR enforcement . Don't forget to subtract out the money they saved from reduced investment in security over that time, as well. Noticeable? Sure. Nowhere near noticeable enough, though, in my opinion. Especially if we're serious about it and recognize this isn't going to be a top 5 fine.

We rightfully see corporations as amorphous entities but I wouldn't like to be the VP/director that this fine gets blamed on. As probably don't other adjacent management staff.

Right - comparing it to a percentage of revenue ignores the managerial aspect of someone having to explain to their boss or to Larry why the $100M budget they manage is going to be 100% over.

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#83
post #10

Earlier quoted context omitted.

Have their been any GDPR fines that amount to more than a rounding error of Oracle's revenue? Admittedly, I don't watch too closely, but from the ones I am aware of, I haven't seen any GDPR fines that made me finally think "wow, that might actually count as a punishment". (I would honestly be happy to learn of some!) There are disclosure laws in the US as well, but again, the fines are like a days worth of revenue. M…

Several of the fines have been in the hundreds of millions of dollars - and while not crushing to Oracle, that's actual money that will definitely change behavior.. https://www.enforcementtracker.com/

If that were true companies wouldn't get fined over and over again year after year.

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#84
post #5

Classic, Oracle denying breach despite clear evidence.

Attempting to admit something to key customers but they don't do it on letterhead!

https://arstechnica.com/security/2025/03/oracle-is-mum-on-re...

Look for them to sue any messengers shortly.

Re: Oracle customers confirm data stolen in alleged cloud breach is valid

#85
post #72
post #7

> BleepingComputer has confirmed with multiple companies that associated data samples shared by the threat actor are valid. > In addition to the data, rose87168 shared an Archive.org URL with BleepingComputer for a text file hosted on the "login.us2.oraclecloud.com" server that contained their email address. This file indicates that the threat actor could create files on Oracle's server, indicating an actual breach.…

This just in... /s Seriously though, Sullivan lost his appeal. You should have read up on this. https://www.courthousenews.com/wp-content/uploads/2025/03/us...

What exactly is the point you are trying to make?

He got in trouble for obstruction of justice and misprison of felony for trying to cover up a breach. Not because there was a breach.

There are basically no punishments for a breach itself. But yes, if you obstruct authorities who investigate, you can get in trouble.

Post reply on HN