Oracle under fire for its handling of separate sec...

Tech big Oracle is dealing with criticism for the way it’s dealing with two seemingly separate knowledge breaches. 

A minimum of one of many incidents seems to nonetheless be unfolding, regardless of Oracle reportedly denying a breach in any respect. The opposite pertains to a breach of affected person knowledge underneath the tech big’s healthcare subsidiary, Oracle Well being.

Oracle didn’t reply to TechCrunch’s request for remark concerning the two incidents.

Oracle Well being breach impacts affected person knowledge, per reviews

The breach disclosed most lately entails Oracle Well being, which supplies hospitals and different healthcare suppliers with know-how to entry well being information on-line. Oracle Well being is a unit that was mixed with Cerner, an digital well being information firm that Oracle acquired in 2022 for $28 billion.

Bloomberg and Bleeping Computer reported final week that the breach impacts affected person knowledge, though it’s unclear precisely what sorts of information have been stolen, nor which organizations and corporations that use Oracle Well being are affected. 

Oracle notified a few of its healthcare clients in March of a breach that occurred someday earlier this 12 months, through which hackers accessed Oracle servers and stole affected person knowledge, in accordance with the publications.

“We’re writing to tell you that, on or round February 20, 2025, we grew to become conscious of a cybersecurity occasion involving unauthorized entry to some quantity of your Cerner knowledge that was on an previous legacy server not but migrated to the Oracle Cloud,” learn the notification despatched to some Oracle Well being clients, in accordance with Bleeping Laptop. 

Citing a number of sources, the information website reported {that a} hacker is making an attempt to extort affected hospitals, reportedly demanding tens of millions of {dollars}. 

An Oracle worker, who requested to stay nameless, as they weren’t approved to talk to the press, instructed TechCrunch that the corporate hasn’t been very clear even with its personal workers. 

“My crew was not capable of entry clients’ environments for quite a lot of days. My concern isn’t just with affected person knowledge breach. Entry by means of hosts permits any and all entry to what’s hosted, clearly,” mentioned the worker. “Some clients host different functions like HR and finance. I don’t know if it was hacker[-]accessed although.”

The worker mentioned they’d to take a look at Reddit and inner Slack channels “to even determine one thing was being checked out.”

The worker mentioned they “felt tremendous ignored,” describing the scenario as: “Nothing to see right here, transfer proper alongside.”

The worker, nonetheless, additionally mentioned that they noticed on Slack that some groups got language to speak with shoppers on March 4: “We’ll examine the difficulty you might be experiencing.”

Oracle denies cloud breach, regardless of mounting proof

The opposite separate breach entails Oracle Cloud servers. And on this case too, Oracle will not be being very clear about what occurred. 

Earlier this month, a hacker going by the net deal with rose87168 posted on a cybercrime discussion board providing the info of six million Oracle Cloud clients, together with authentication knowledge and encrypted passwords, as Bleeping Laptop reported on the time. 

To show that they breached Oracle, rose87168 uploaded a text file containing their online handle that was hosted on an Oracle Cloud server.

Since, several Oracle customers have confirmed that knowledge samples shared by the hacker seem real, pointing to additional proof of a breach at Oracle.

Unusually, Oracle denied that there was a breach in any respect. 

“There was no breach of Oracle Cloud. The printed credentials will not be for the Oracle Cloud. No Oracle Cloud clients skilled a breach or misplaced any knowledge,” Oracle instructed the publication.

However not everyone seems to be satisfied. 

“It is a severe cybersecurity incident which impacts clients, in a platform managed by Oracle,” cybersecurity professional Kevin Beaumont wrote in a blog post analyzing the alleged Oracle Cloud breach. “Oracle are trying to wordsmith statements round Oracle Cloud and use very particular phrases to keep away from duty. This isn’t okay.” 

“Oracle want to obviously, overtly and publicly talk what occurred, the way it impacts clients, and what they’re doing about it. It is a matter of belief and duty. Step up, Oracle — or clients ought to begin stepping off,” mentioned Beaumont.

Commenting on one of many alleged Oracle breaches, cybersecurity professional Lisa Forte wrote on Bluesky that, “if this finally ends up being true, and I wrestle to see the way it received’t, this can be a very very unhealthy look.”