Alleged Oracle Cloud Supply Chain Attack: Six Million Records Stolen, 140K Companies Affected

Alleged Oracle Cloud SSO/LDAP data breach was posted to Breach Forums on 20 March 2025 claiming six million records and a list of 140,000 impacted organizations; items purportedly include encrypted passwords, JKS and key files. Oracle denies data loss, while CloudSEK reports a compromised production SSO endpoint potentially tied to a known Fusion Middleware vulnerability; evidence is currently unverified. Arctic Wolf and others recommend resetting/rotating Oracle SSO/LDAP credentials, enforcing MFA, and updating authentication methods as a precaution.