On 20 March 2025 a hacker using the name "rose87168" claimed on BreachForums to have stolen about 6 million records from Oracle Cloud's single sign-on and LDAP systems, affecting more than 140,000 tenants. The claimed haul included Java keystore (JKS) files, key files, Enterprise Manager JPS keys and encrypted SSO and LDAP passwords: the machine secrets that let Oracle's login service trust and sign for its customers. CloudSEK made the claim public on 21 March. Oracle's public answer, the same week, was "There has been no breach of Oracle Cloud." Several companies then told BleepingComputer that sample data was genuine, and an archived page suggested the hacker had written a file to Oracle's login.us2.oraclecloud.com server. In April Oracle told customers by email that a hacker had accessed two obsolete servers that were never part of Oracle Cloud Infrastructure, and that "No OCI customer data has been viewed or stolen." The full claim remains unconfirmed by Oracle, so this page treats it as a claimed breach.
Key takeaways
- rose87168 claims to have taken about 6 million records from Oracle Cloud SSO and LDAP, including JKS keystores, key files and Enterprise Manager JPS keys, and listed 140,621 domains allegedly affected, according to BleepingComputer.
- CloudSEK linked the claimed entry point, login.us2.oraclecloud.com, to Oracle Fusion Middleware 11g and to CVE-2021-35587 in Oracle Access Manager, without confirming that flaw was used.
- Several companies confirmed to BleepingComputer that names and email addresses in the samples were theirs. An Archive.org capture from 1 March 2025 shows a text file on the login server that the hacker said contained their email address.
- Oracle publicly denied any breach of Oracle Cloud. In April it told customers by email that two obsolete servers, which it says were never part of Oracle Cloud Infrastructure, had been accessed and usernames published.
- The identity lesson: a cloud login service's keystores and signing keys are the trust anchor for every tenant behind it, so a legacy server that still holds them is part of the attack surface, whatever it is called.
At a glance
| Organisations | Oracle (Oracle Cloud login and SSO service; Oracle says the affected servers were legacy "Oracle Cloud Classic" systems, not OCI); more than 140,000 tenants claimed by the attacker |
|---|---|
| When | Claim posted 20 March 2025; made public by CloudSEK 21 March 2025; Oracle denial 21 March 2025; Oracle customer emails in early April 2025 |
| Attacker | "rose87168", a BreachForums user active since January 2025, according to CloudSEK; not linked to a known group |
| Entry point | Claimed exploitation of a known vulnerability on login.us2.oraclecloud.com, which CloudSEK found running Oracle Fusion Middleware 11g; CVE-2021-35587 suggested but not confirmed |
| Identities abused | Claimed: JKS keystore files, key files and Enterprise Manager JPS keys for the SSO service, plus encrypted SSO and LDAP passwords for tenant users |
| Impact | Claimed theft of 6 million records across 140,000+ tenants; partly verified by customers confirming sample data; Oracle says only usernames from two obsolete servers were published |
| Category | NHI. Incident class: confirmed NHI breach, claimed (the attacker's claim is partly verified: Oracle privately told customers legacy login servers were accessed, but publicly denies a breach of Oracle Cloud) |
What happened
Oracle Cloud's federated login service authenticates users from customer tenants and issues the tokens other Oracle services trust. To do that it relies on machine secrets: keystores holding private keys and certificates, and configuration keys used by Oracle's identity middleware. On 20 March 2025, according to Arctic Wolf, rose87168 posted on BreachForums offering about 6 million records taken from Oracle Cloud's SSO and LDAP. CloudSEK's XVigil service spotted the listing on 21 March and published the details: JKS files, encrypted SSO passwords, key files and Enterprise Manager JPS keys. The hacker asked affected companies to pay to have their data removed and offered rewards to anyone who could decrypt the passwords. SecurityWeek reported that they first sought $20 million.
The hacker said they had got in through login.us2.oraclecloud.com by exploiting a public CVE. CloudSEK found a Wayback Machine capture showing the server ran Oracle Fusion Middleware 11g as of 17 February 2025, and pointed to CVE-2021-35587, an Oracle Access Manager flaw already on CISA's exploited list, while describing the evidence as pointing to "a possible undisclosed vulnerability on login.(region-name).oraclecloud.com". BleepingComputer found an Archive.org snapshot from 1 March 2025 of a text file on the same server that the hacker said contained their email address, which suggested they could write files there. The server was later taken offline. BleepingComputer also obtained a list of 140,621 domains, some of them test domains, and several companies confirmed that LDAP display names, email addresses and given names in the samples were accurate.
Oracle's response came on 21 March. A spokesperson said, as quoted by The Register: "There has been no breach of Oracle Cloud," and "The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data." Researcher Kevin Beaumont accused Oracle of "attempting to wordsmith statements around Oracle Cloud and use very specific words to avoid responsibility". In early April, Bloomberg reported, and BleepingComputer relayed, that Oracle had privately told some customers that old client credentials were stolen from a "legacy environment" last used in 2017, with the FBI and CrowdStrike investigating. The hacker had shared data from late 2024 and 2025. Cybersecurity firm CybelAngel said Oracle told clients an attacker had placed a web shell on Gen 1, or Oracle Cloud Classic, servers as early as January 2025 and exfiltrated data, with malware that targeted the Oracle Identity Manager database, until the breach was detected in late February.
On 9 April BleepingComputer reported Oracle's email to customers. It said a hacker had accessed and published usernames from two obsolete servers that were never part of Oracle Cloud Infrastructure, that passwords on them were encrypted or hashed, and that "No OCI customer data has been viewed or stolen." Beaumont responded that "Oracle rebadged old Oracle Cloud services to be Oracle Classic." Oracle has not publicly confirmed the theft of keystores or keys, and no public account says whether the claimed JKS files and JPS keys were genuine or have been replaced.
Timeline
| Date | Event |
|---|---|
| January 2025 | An attacker may have had access to Gen 1 (Oracle Cloud Classic) servers, according to CybelAngel's account of Oracle's notice to clients. |
| 17 February 2025 | A Wayback Machine capture shows login.us2.oraclecloud.com running Oracle Fusion Middleware 11g, according to CloudSEK. |
| 1 March 2025 | An Archive.org capture shows the hacker's text file on login.us2.oraclecloud.com. |
| 20 March 2025 | rose87168 posts the claim on BreachForums. |
| 21 March 2025 | CloudSEK publishes the claim; Oracle says there has been no breach of Oracle Cloud. |
| 26 March 2025 | BleepingComputer reports that several companies confirm sample data is genuine. |
| 3 April 2025 | BleepingComputer, citing Bloomberg, reports Oracle privately confirming a breach of a legacy environment to customers. |
| 9 April 2025 | BleepingComputer reports Oracle's email saying two obsolete, non-OCI servers were accessed. |
How it happened: the identity attack path
- An old login server stays online. According to CloudSEK, login.us2.oraclecloud.com was running Oracle Fusion Middleware 11g in February 2025.
- Exploit a known flaw. The hacker says they used a public CVE to gain access; CloudSEK points to CVE-2021-35587 in Oracle Access Manager, but this is not confirmed.
- Reach the identity stores. The hacker claims to have taken SSO and LDAP data, including encrypted passwords for tenant users.
- Take the machine secrets. The hacker also claims JKS keystores, key files and Enterprise Manager JPS keys, which, if genuine, would underpin how the login service authenticates and signs.
- Monetise the claim. The hacker offered the data for sale, demanded payment from tenants for removal and sought help cracking the passwords.
Impact
- Confirmed by Oracle (privately, to customers): a hacker accessed two obsolete servers that Oracle says were not part of OCI and published usernames; Oracle says no OCI customer data was viewed or stolen.
- Partly verified: several companies confirmed to BleepingComputer that names and email addresses in the samples were theirs; an archived file on Oracle's login server supports the claim of write access.
- Claimed: about 6 million records from more than 140,000 tenants, including encrypted SSO and LDAP passwords, JKS keystores, key files and Enterprise Manager JPS keys.
- Potential: if keystores and keys were genuine and still in use, forged or decrypted authentication material for affected tenants; cracked passwords reused elsewhere.
What this means for NHI governance
The most serious part of the claim is not the user records but the machine secrets. Keystores and middleware keys are how a login service proves who it is and protects what it issues. If an attacker holds them, the damage is not limited to the users in a database dump. We list the incident because those secrets are non-human identities, and because the dispute over where the servers sat ("Oracle Cloud" or "Oracle Classic") is exactly the kind of boundary that lets legacy systems keep live credentials without anyone owning their rotation.
For customers, the practical response was the same whatever Oracle called the servers: rotate passwords and credentials for SSO and LDAP accounts, and replace any keys, certificates or secrets that might have been exposed. The episode also shows how hard it is to judge exposure when the provider's public and private statements differ. Our Identity Provider and SSO Security Guide and Machine Identity, PKI and Certificate Lifecycle Guide cover protecting the keys behind a login service.
Recommendations
- Rotate credentials tied to a disputed provider breach. Do not wait for confirmation: reset SSO and LDAP passwords and rotate any secrets the provider's login service held for your tenant. See our Leaked Credential Response Playbook.
- Replace keys and certificates exposed with an identity service. Treat keystores and signing keys as compromised if they could have been on an affected server, and reissue them. See our Machine Identity, PKI and Certificate Lifecycle Guide.
- Decommission legacy identity infrastructure fully. Old login servers and middleware should be shut down and their keys revoked, not just rebadged. See our Identity Provider and SSO Security Guide.
- Patch identity middleware first. CVE-2021-35587 was fixed in early 2022; identity components exposed to the internet should be at the front of the patch queue.
- Ask providers direct questions. Ask which systems, keys and tenants were affected, in writing, and record the answer in your third-party risk file. See our Third-Party Access Guide.
Frequently asked questions
Did Oracle Cloud really get breached in 2025?
Oracle has not publicly confirmed a breach of Oracle Cloud and says no OCI customer data was viewed or stolen. It did tell customers privately that a hacker accessed two obsolete servers it says were never part of OCI. Customers confirmed some leaked sample data to BleepingComputer, so the claim is partly verified but not confirmed in full.
What data did rose87168 claim to steal from Oracle?
About 6 million records from Oracle Cloud's SSO and LDAP systems, including Java keystore files, key files, Enterprise Manager JPS keys and encrypted SSO and LDAP passwords, affecting more than 140,000 tenants according to the hacker.
What should Oracle Cloud customers do after the breach claim?
Arctic Wolf and others advised resetting or rotating Oracle SSO and LDAP passwords and associated credentials, enforcing MFA and strong password policies, and regenerating any keys or hashes that could have been exposed, especially for organisations on the hacker's domain list.
Related NHI Mgmt Group resources
Oracle E-Business Suite exploitation 2025 · ShinyHunters FBI breach claim 2026 · Microsoft Storm-0558 key breach 2023 · Identity Provider and SSO Security Guide · Machine Identity, PKI and Certificate Lifecycle Guide
How NHI Mgmt Group can help
Keys, keystores and certificates behind identity services are some of the most powerful non-human identities an organisation depends on, and often among the least tracked. We help teams inventory them, plan rotation and respond quickly when a provider reports, or denies, a breach. See our NHI Foundation Level Training Course.
References
- CloudSEK: The Biggest Supply Chain Hack of 2025: 6M Records for Sale Exfiltrated from Oracle Cloud Affecting over 140k Tenants (21 March 2025)
- Arctic Wolf: Alleged Oracle Cloud Supply Chain Attack: Six Million Records Stolen, 140K Companies Affected (24 March 2025)
- BleepingComputer: Oracle customers confirm data stolen in alleged cloud breach is valid (26 March 2025)
- The Register: Oracle Cloud security SNAFU latest: IT giant accused of pedantry as evidence scrubbed (31 March 2025)
- BleepingComputer: Oracle privately confirms Cloud breach to customers (3 April 2025)
- SecurityWeek: Oracle Confirms Cloud Hack (4 April 2025)
- BleepingComputer: Oracle says 'obsolete servers' hacked, denies cloud breach (9 April 2025)