Oracle Denies Claim of Oracle Cloud Breach of 6M Records

Researchers at CloudSEK allege a threat actor (rose87168) breached Oracle Cloud SSO/LDAP — possibly via a WebLogic/Oracle Access Manager vulnerability or an as-yet-unreleased zero-day — exfiltrating 6 million records (including JKS, encrypted SSO passwords, key files) which are being offered for sale and used for extortion; Oracle denies any breach, and CloudSEK published corroborating evidence and a tool for customers to check exposure.