Potential Oracle Cloud Breach

Update timeline

1. investigating Mar 27, 2025, 04:04 PM UTC

   On March 21, 2025, A major security incident was reported involving Oracle Cloud’s authentication systems. A threat actor known as “rose87168” has claimed responsibility for the breach, alleging the theft of 6 million records affecting over 140,000 tenants. The compromised data is said to include: - JKS (Java KeyStore) files - Encrypted SSO and LDAP credentials - JPS (Java Platform Security) keys The attacker claims to have accessed login endpoints belonging to Oracle: login..oraclecloud.com While Oracle has publicly denied that a breach occurred, multiple independent sources have claimed to have verified the authenticity of the stolen data, which allegedly contains production information from impacted customers. This incident remains under active evaluation, we are committed to providing timely updates, insights, and recommendations to ensure our customers remain secure. A detailed AXON report outlining our findings, insights, and recommended actions will be shared upon the conclusion of our Rapid Response efforts. If you have any questions or concerns, please do not hesitate to contact us. Sincerely, Team AXON

2. resolved Mar 30, 2025, 08:03 AM UTC

   This incident is currently being actively monitored by Team Axon. Any new information or developments will be promptly updated on this page. If you have any questions or concerns, please feel free to contact us. Sincerely, Team Axon