Oracle Appears to Admit Breach of 2 'Obsolete' Servers

Oracle notified some customers of a breach involving two obsolete non-OCI servers after a threat actor ("rose87168") claimed to have exfiltrated about 6 million records from Oracle SSO/LDAP and related key files; Oracle maintains the data on those servers was hashed/encrypted and that no OCI customer environments were breached. Researchers and vendors (CloudSEK, Trustwave) observed attempts to sell the data and raised concerns that usernames and cryptographically protected credentials could still present risk through aggregation, credential stuffing, or potential decryption depending on implementations.