Oracle attempt to hide cybersecurity incident from customers?
11–20 of 136 posts
Re: Oracle attempt to hide cybersecurity incident from customers?
#12how is that not securities fraud? they are under legal obligation to tell investors about this sort of shit.
Welcome to the (most recent) era of deregulation. Get ready for all Fortune 500s to deny, deny, deny, and bribe.
Crypto is a prime asset for bribing. Not for nothing the president has his own shit coin.
Re: Oracle attempt to hide cybersecurity incident from customers?
#13There are various state laws that require companies to notify their customers of security breaches, but they lack enforcement/teeth so they're routinely ignored. It'll never happen in our current environment but we really need a federal law that causes violators enough pain that companies will actually bother to follow the law.
While that's true, many enterprise customers are going to have MSAs with notification requirements that have contractual punishments for failure to notify of material security incidents. Those are probably what Oracle is trying to avoid.
Re: Oracle attempt to hide cybersecurity incident from customers?
#14There are various state laws that require companies to notify their customers of security breaches, but they lack enforcement/teeth so they're routinely ignored. It'll never happen in our current environment but we really need a federal law that causes violators enough pain that companies will actually bother to follow the law.
While that's true, many enterprise customers are going to have MSAs with notification requirements that have contractual punishments for failure to notify of material security incidents. Those are probably what Oracle is trying to avoid.
I believe enterprise customers are not going to care much unless it helps with lowering existing costs.
OTOH, Oracle as part of BSA can demand an audit so they will inflict / make up reason to also punish (i.e. licensing or pull support). The business could invoke an MSA punishment clause and win temporarily but it will cause a headache going forward (further demands from Oracle, higher costs etc.)
Either way, Oracle gets what they want.
Re: Oracle attempt to hide cybersecurity incident from customers?
#15how is that not securities fraud? they are under legal obligation to tell investors about this sort of shit.
they likely aren't under an obligation to tell investors about it immediately and simply putting something in their quarterly report about it will probably be fine.
That being said if they put something in some communication that said "we take security seriously" or something that would probably be grounds to sue as this obviously shows they aren't serious or something. The barriers to shareholder lawsuits for securities fraud are pretty low.
Re: Oracle attempt to hide cybersecurity incident from customers?
#16This is honestly wild. Whether we like it or not security incidents have become such common place in the last several years that if they just admitted to it this entire story would have likely been shrugged off and mostly forgotten about in a couple days but instead it is turning into an entire thing that just seems to be getting deeper and deeper. (Not downplaying the security incident, but that is the unfortunate r…
> Seriously if I can't trust that I am going to actually be told and not lied too when there is a security incident at the bare minimum, why would I chose to work with a company? What is Oracle's end goal here?
I think you're coming at this from the wrong point of view. Oracle couldn't care in the slightest about what regular people think of them. Remember, they are the company that sent lawyers after the employers of folks who downloaded non-free but bundled by default extensions to VirtualBox, and the company that declared that you need to license every core their software could _potentially_ run on in your virtualisation estate (so if you have a 8 vCPU VM for some Oracle software, you need licenses for however many physical cores you have on your cluster). They've variously been described as a law firm with an engineering side business, and One Rich Asshole Called Larry Ellisson. Speaking of whom, he multiple times flat out lied on stage to make his shitty "cloud" nobody cares about seem relevant compared to AWS.
Nobody buys Oracle because they like them or their good reputation. You buy them because you have legacy stuff that depends on them and you have no choice (even Amazon took many years to get off Oracle databases, and they wrote a gloating success story one they were done with it because they were that happy to be rid of the leeches), or because your bosses' boss was convinced at a golf course they're getting a good deal. Or because their bandwidth is very cheap and you accept the risk of dealing with the devil incarnate with zero morals. (cf. Zoom).
Oracle is like Broadcom. Everyone hates their guts, everyone who worked there has a black mark on their CV. Yet they persist, continue leeching off companies too scared to make the jump elsewhere.
Re: Oracle attempt to hide cybersecurity incident from customers?
#17Re: Oracle attempt to hide cybersecurity incident from customers?
#18This is honestly wild. Whether we like it or not security incidents have become such common place in the last several years that if they just admitted to it this entire story would have likely been shrugged off and mostly forgotten about in a couple days but instead it is turning into an entire thing that just seems to be getting deeper and deeper. (Not downplaying the security incident, but that is the unfortunate r…
I'm guessing nobody chooses to work with Oracle anymore for reasons or in situations that we would consider reasonable. It's probably either governments contracts, with or without corruption, companies already locked in, contracts made by executives that don't really understand technology, that sort of thing.
Re: Oracle attempt to hide cybersecurity incident from customers?
#19how is that not securities fraud? they are under legal obligation to tell investors about this sort of shit.
Welcome to the (most recent) era of deregulation. Get ready for all Fortune 500s to deny, deny, deny, and bribe.
Presumably the requirements for public companies to disclose stuff and generally follow all kinds of rules were somehow for the health of the markets or something like that. I wonder how the markets will fare with the rules neutered.
To be fair, they're trending down at the moment, so maybe there was something there. But truly only time will tell.
Re: Oracle attempt to hide cybersecurity incident from customers?
#20Pretty on par for what I expect from Oracle. I'm surprised there's no corporate contracts involved yet.
The hacker is following a number of corporations. Is it an empty threat or a hint?