Oracle Denies Breach, But Researchers and Customers Confirm: The Data Is Real

On March 20, 2025, a hacker using the alias _rose87168_ posted on BreachForums offering more than 6 million records stolen from over 140,000 Oracle Cloud tenants, including SSO/LDAP credentials, OAuth2 keys, and internal configurations. Oracle denied any breach via a statement to The Register, but Trustwave Holdings Inc. analyzed samples and confirmed consistency with real Oracle environments, while BleepingComputer verified authenticity by contacting affected companies directly. The incident resurfaces the CVE-2021-35587 vulnerability, patched in January 2022 but still present on exposed endpoints.

On March 20, 2025, a hacker using the alias _rose87168_ posted on BreachForums offering more than 6 million records stolen from over 140,000 Oracle Cloud tenants, putting SSO/LDAP credentials, OAuth2 keys, and internal configurations up for sale. Oracle denied any breach through a spokesperson quoted by The Register, but Trustwave Holdings Inc. analyzed the samples and reported consistency with real Oracle environments, while BleepingComputer verified authenticity by contacting affected companies directly. The incident resurfaces the CVE-2021-35587 vulnerability, patched in January 2022 but still present on exposed endpoints.

Key Takeaways

The hacker _rose87168_ claimed on March 20, 2025 to possess 6 million records from over 140,000 Oracle Cloud tenants, including identity federation credentials and keys.
Oracle publicly denied the breach; Trustwave and BleepingComputer instead confirmed the authenticity of leaked data samples through direct verification with affected companies.
The exploited vulnerability is CVE-2021-35587 in Oracle Access Manager, with a CVSS 9.8 CRITICAL score, fixed in Oracle's January 2022 Critical Patch Update but unpatched on exposed cloud systems.
By mid-April 2025, Oracle reportedly began private customer notifications describing the event as a "legacy system" breach, contradicting the initial public denial.

The Mechanism: CVE-2021-35587 and the Patch Gap on Exposed Cloud Systems

The CVE-2021-35587 vulnerability affects Oracle Access Manager, a component for federated identity and access management. The National Vulnerability Database assigns the flaw a CVSS 3.1 score of 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network access, low complexity, no privileges required, no user interaction, maximum impact on confidentiality, integrity, and availability. Oracle released the fix in the January 2022 Critical Patch Update. CISA added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog in November 2022, signaling active exploitation in the wild.

According to Audita.tech, citing CloudSEK analysis, the hacker exploited Oracle Cloud endpoints that remained exposed and unpatched since 2022. The persistence of legacy systems running vulnerable Access Manager in cloud environments — despite fixes being available for over three years — points to a patch hygiene problem on vendor-managed or co-managed infrastructure.

The Evidence: When Vendor and Researchers Say Different Things

The primary source, Federprivacy, reports Oracle's statement via The Register: "there was no breach of Oracle Cloud... the published credentials are not for Oracle Cloud. No Oracle Cloud customer experienced a breach or lost data." The wording is semantically precise: Oracle Cloud as a branded product, not "Oracle Cloud" as any resource hosted by Oracle.

Countering this denial, Trustwave Holdings Inc. published analysis on March 27, 2025 attesting that the structure of the data for sale is consistent with real Oracle environments. BleepingComputer conducted direct verification: it contacted companies named in the samples and obtained confirmation of authenticity. The discrepancy between Oracle's public denial and independent confirmations forms the core of the ambiguity investigated in this article.

The "Technical Denial" as Communication Strategy

By mid-April 2025, according to Audita.tech, Oracle began private notifications to customers describing the event as a breach of a "legacy system." This information, reported indirectly, if confirmed documents a communication bifurcation: absolute public denial, circumscribed private admission.

"Oracle's initial denial complicated incident response for hundreds of organizations, which didn't know whether to act or wait" — Kevin Beaumont, independent researcher, cited by Audita.tech

Kevin Beaumont's quote identifies a measurable operational cost: the delay in credential rotation and activation of compensating controls.

Why It Matters

It does not document whether the private keys in the actor's possession are cryptographically active or revocable, nor the actual volume of data truly compromised versus the 6 million claimed.

It does not specify whether privacy authorities or the SEC have launched formal investigations. The status of Oracle's internal investigations remains unknown.

The incident fits a broader pattern of vendor "breach denial": technically defensible statements — "no breach of branded service X" — that operationally delay customer response. For enterprises with identity federation to on-premise systems, the compromise of SSO/LDAP credentials in the cloud exposes corporate directories regardless of the event's official classification.

Questions the Case Raises

How can a vendor technically deny a breach and admit it privately?

Why is a vulnerability patched in 2022 still exploitable in 2025?

What exactly do affected companies confirm?

Trustwave reported consistency with real Oracle environments. BleepingComputer obtained authenticity confirmation from directly contacted companies. The precise number of confirmations remains unknown.

The Oracle Cloud case of March–April 2025 is not resolved by the technical verification of a breach, but by measuring the gap between what a vendor can legitimately deny in public and what its customers must instead presume true to protect themselves. When federated credentials and corporate access keys circulate on criminal forums, the distinction between "cloud" and "legacy" is semantic for the press release, not for the security team that must rotate passwords and invalidate sessions. The cost of technical denial is not reputational: it is operational, measured in days of delay in responding to an incident already underway.

Sources

Sources and references

Get DeafLetter