Oracle Suffers Second Massive Data Breach Within One Month

Oracle allegedly told some of its customers that it suffered a second major data breach, in which the bad actor stole old client log-in credentials, as reported by Bloomberg on April 2nd.

This news comes just a month after a hacker with the handle “rose87168” was caught by CloudSEK’s XVigil selling six million records exfiltrated from Oracle Cloud’s SSO and LDAP – considered the biggest supply chain of 2025 (so far).

The database from the first attack (reported on March 21st) contained information on JSK files, encrypted SSO passwords, key files, and enterprise manager JSP keys, affecting over 140,000 tenants.

Although Oracle completely denied the breach, CloudSEK published further evidence in a later post.

When it comes to the second attack, Oracle reported that the stolen credentials were from a server that hadn’t been operating for several years. However, the report mentioned that some of the credentials are from 2024.

Considering how Oracle has been responding to these data breaches, we can’t say for certain that the company is taking good care of its customers’ data.

We all know that a data breach can break a business (especially smaller ones), so it’s imperative to take matters into your own hands.

If you’re an Oracle user, the first steps you should take are:

• Change all SSO, LDAP, and associated passwords.
• Enforce multi-factor authentication in your team.
• Investigate thoroughly if there has been any unauthorized access and mitigate risks.
• Contact your customers and let them know what is happening. Send out updates as you find new information and reassure them you’re doing everything in your power to understand the extent of the breach.
• Monitor the dark web and forums to keep track of updates in the leaked data.

Oracle is just one of the many companies suffering data breaches. Since we can’t stop using cloud tools and develop everything in-house, we recommend reading our quick guide on how to protect your business from supply chain attacks.