Part 2: Validating the Breach Oracle Cloud Denied – CloudSEK’s Follow-Up Analysis

On 21 March 2025 CloudSEK published evidence that a threat actor ('rose87168') posted data allegedly exfiltrated from an Oracle Cloud SSO endpoint (login.us2.oraclecloud.com), claiming up to 6 million records and widespread tenant impact; CloudSEK verified artifacts (archived file, GitHub references, tenant matches) and released analysis and remediation guidance while Oracle denied a breach, and the actor later released a 10,000-line sample implicating 1,500+ organizations and raising supply-chain and credential compromise risks.