While Oracle remains silent about the data offered on the dark web, initial customers have reportedly confirmed the authenticity of the data sets. The alleged leak is said to contain 6 million data records and even encrypted passwords.
According to the Bleeping Computer portal, a hacker calling himself "rose87168" claims to have compromised the Oracle Cloud and stolen data from 6 million users. This data allegedly includes encrypted passwords, LDAP entries, and authentication credentials. Although Oracle officially denies such an incident occurred, several companies have reportedly already confirmed the authenticity of the leaked data.
Hacker wants 6 million records
The exploited vulnerability appears to be related to a known vulnerability (CVE-2021-35587) in Oracle Fusion Middleware 11g. This vulnerability allows attackers to gain unauthorized access to sensitive data. What's particularly worrying is that this vulnerability has been known since 2021 and apparently wasn't patched in a timely manner.
According to the portal, the hacker not only claims to have stolen the data. He also claims to have left a file with his email address on the server. This is supposed to prove that he had access to the servers. Despite this evidence, Oracle maintains that no data was compromised.
Subscribe to our newsletter now
Read the best news from B2B CYBER SECURITY once a monthsecurity researcher from CloudSEK have also investigated the incident and have already published two blog articles about the incident. It's therefore all the more surprising that Oracle is still denying the incident.
For you as a user of cloud services, this incident is a wake-up call. It demonstrates how important it is for companies to quickly close security gaps and take proactive measures. This includes regular updates, implementing multi-factor authentication (MFA), and reviewing access logs. Communication between companies and users also plays a crucial role in maintaining trust and minimizing potential damage.
More at Bleepingcomputer.com