CISA warns of potential data breaches caused by legacy Oracle Cloud leak

Federal agencies and multiple security firms reported that a threat actor known as "rose87168" stole roughly 6 million records from legacy Oracle Cloud SSO/LDAP servers, affecting over 140,000 tenants; the data set reportedly contains usernames, encrypted passwords, keys and authentication tokens that the actor is selling and attempting to decrypt. Oracle says the compromised servers were obsolete and not part of OCI, while CISA urged password resets, code review, monitoring for anomalous authentication, and reporting incidents; FBI and CrowdStrike investigations are ongoing.