Photo credit: arstechnica.com
Oracle Cloud Data Breach Concerns Emerge
According to Trustwave’s Spider Labs, a recent analysis of a leaked sample of LDAP credentials suggests significant vulnerabilities within Oracle’s multi-tenant cloud environment. The reported data contains sensitive identity and access management (IAM) information linked to a user, including personally identifiable information (PII) and administrative role assignments. This raises alarms regarding potentially unauthorized access to valuable enterprise systems.
Initially, Oracle firmly refuted claims of any breach within its cloud infrastructure. The company stated, “There has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data.” This denial aims to reassure clients regarding the security of their data within Oracle’s systems.
Further complicating matters, a spokesperson from Oracle requested the opportunity to provide a statement that could not be directly attributed to the company, but when prompted, the spokesperson ultimately stated that Oracle would offer no additional comment on the situation.
This situation has led to a standoff, with Oracle on one side and security researchers and journalists on the other, regarding the existence of potential data breaches that may have compromised customer information. Reports that Oracle is allegedly sending notifications about data breaches to clients on unofficial letterhead through external counsel have further intensified concerns. As this story develops, updates will be provided as new information is made available.
Source
arstechnica.com