Oracle Hack: From ‘Deny-Deny-Deny’ to ‘Oops-Oops-Oops’ – Source: securityboulevard.com

Larry’s PR angels desperately dance on the head of a  pin.

Oracle is now admitting that, yes, an Oracle cloud service was breached—or so we’re told by deep throat sources. This is, of course, despite last week’s vehement denials.

Yet it’s still not official. And Oracle seems to be justifying its previous denial with a semantic sleight-of-hand worthy of Bill Clinton. In today’s SB  Blogwatch, we see men tic.

Your humble blog­watcher curated these bloggy bits for your enter­tain­ment. Not to mention:  Happy Birthday.

Classic ‘Wordplay’

What’s the craic? Jake Bleiberg and Julie Zhu report: Oracle Tells Clients of Second Recent Hack, Log-In Data Stolen

“Log-in credentials from as recently as 2024”
Oracle Corp. has told customers that a hacker broke into a computer system and stole old client log-in credentials, according to two people familiar with the matter. … The attacker gained access to usernames, passkeys and encrypted passwords, according to the people, who spoke on condition that they not be identified.
…
Information about the stolen credentials started coming out last [week], when … Oracle denied that its cloud storage product had been hacked: … “There has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data.” [But] this week, Oracle staff acknowledged to some clients that an attacker had gotten into what the company called a “legacy environment,” according to the people. [One] person familiar with the breach said the stolen data included Oracle customer log-in credentials from as recently as 2024.

This feels odd. More detail please? Sergiu Gatlan digs in: Oracle privately confirms Cloud breach to customers

“Oracle has consistently denied reports of a breach”
Oracle has finally acknowledged to some customers that attackers have stolen old client credentials after breaching a “legacy environment.” … However, while Oracle told clients this is old legacy data that is not sensitive, the threat actor behind the attack has … posted newer records from 2025.
…
Cybersecurity firm CybelAngel first revealed that Oracle told clients that an attacker who gained access to … Oracle Cloud Classic servers as early as January 2025. … The attacker allegedly exfiltrated data from the Oracle Identity Manager (IDM) database, including user emails, hashed passwords, and usernames.
…
Oracle has consistently denied reports of a breach in Oracle Cloud in statements shared with the press since the incident surfaced. … An Oracle spokesperson was not immediately available for comment.

Not available? Or not willing? Dan Goodin goes with the latter:

When I asked Oracle for comment, a spokesperson asked if they could provide a statement that couldn’t be attributed to Oracle in any way. After I declined, the spokesperson said Oracle would have no comment.

No doubt Dan’s now on a permanent PR blocklist. CybelAngel’s Todd Carroll isn’t in favor either: Our Investigation of the Oracle Cloud Data Leak

“Payment of 20 million USD”
Oracle has allegedly determined an attacker was in the shared identity service as early as January 2025. This exposure was facilitated via a 2020 Java exploit and the hacker was able to install a webshell along with malware [that] specifically targeted the Oracle IDM database.
…
Oracle allegedly became aware of a potential breach in late February and investigated this issue internally. … The requested ransom is a payment of 20 million USD.

Ouch. Kevin Beaumont has harsh words for ORCL: Oracle attempt to hide serious cybersecurity incident

“Step up, Oracle”
It has now become 100% clear … there has been cybersecurity incident at Oracle, involving systems which processed customer data. … Multiple Oracle cloud customers have reached out to me to say Oracle have now confirmed a breach of their services. [Oracle is] only doing so verbally, they will not write anything down.
…
Oracle are attempting to wordsmith statements around Oracle Cloud and use very specific words to avoid responsibility. This is not okay. … Oracle rebadged old Oracle Cloud services to be Oracle Classic. Oracle Classic has the security incident. Oracle are denying it’s on “Oracle Cloud” by using this … wordplay.
…
This is a matter of trust and responsibility. Step up, Oracle — or customers should start stepping off.

What have Larry’s lot got to hide? nerdjon tries to figure it out:

Whether we like it or not, security incidents have become such commonplace in the last several years that if they just admitted to it, this entire story would have likely been shrugged off and mostly forgotten about. … Instead it is turning into an entire thing that just seems to be getting deeper and deeper.
…
Seriously, if I can’t trust that I am going to actually be told and not lied to when there is a security incident, … why would I chose to work with a company? What is Oracle’s end goal here? … Trying to think about how this is anything except them just straight up lying.

Are you pondering what I’m pondering? Doctor Syntax seems to be:

Googling “Streisand Effect” might be an education. … Do they learn nothing in PR school?

PR shens aside, let’s get back to the real issue. It’s “criminal negligence,” according to kurkosdr

Oracle didn’t update Oracle Access Manager in their Oracle Cloud Classic product, leaving a known vulnerability from 2021 unpatched, which was then exploited by a third party. Imagine taking 4 years to update your own software running on your own service.

What’ll this do to Oracle’s reputation? If Brendan McKinley’s opinion is anything to go by, it couldn’t get much worse:

Remember the old tech industry proverb: Oracle doesn’t have customers, they have hostages. … Why any corporation would voluntarily rely on them for cloud services is beyond me.

Meanwhile, u/Feisty_Donkey_5249 muses on marketing:

“Unbreakable,” to quote their advertising.

And Finally:

This is … something

Previously in And Finally

You have been reading SB Blogwatch by Richi Jennings. Richi curates the best bloggy bits, finest forums, and weird­est web­sites—so you don’t have to. Hate mail may be directed to  @RiCHi, @richij, @[email protected], @richi.bsky.social or [email protected]. Ask your doctor before reading. Your mileage may vary. Past per­formance is no guar­antee of future results. Do not stare into laser with re­maining eye. E&OE. 30.

Image sauce: U.S. State Department