Oracle admits second major security breach, user login data stolen

Oracle
(Image credit: Oracle)

  • Several reports claim a second Oracle data breach has occured
  • User login credentials were apparently stolen
  • Oracle allegedly told some customers that the data is almost a decade old

Oracle has apparently suffered its second cyberattack in a month, but the company is downplaying its importance.

A Bloomberg report citing two people familiar with the matter has claimed Oracle told some of its customers a threat actor compromised its IT infrastructure and stole client login credentials.

At the same time, Reuters is reporting that an unidentified threat actor tried to sell the stolen data on the dark web, claiming to have stolen it from Oracle’s Austin, Texas premises.

Monitor your credit score with TransUnion starting at $29.95/month

Monitor your credit score with TransUnion starting at $29.95/month

TransUnion is a credit monitoring service that helps you stay on top of your financial health. With real-time alerts, credit score tracking, and identity theft protection, it ensures you never miss important changes. You'll benefit from a customizable online interface with clear insights into your credit profile. Businesses also benefit from TransUnion’s advanced risk assessment tools.

Preferred partner (What does this mean?)

Old data

Bloomberg also reported that Oracle told some of its clients that the FBI was notified, and that CrowdStrike was brought in to investigate. Furthermore, the clients were notified that this is not the same incident that struck healthcare customers in March 2025. Finally, the attacker also tried to extort Oracle for the stolen data.

Oracle has hinted that the data isn’t that relevant, however, claiming that the compromised system was not used for eight years. Therefore, the conclusion is that the data found there is outdated and poses little risk.

However, there were Oracle customer login credentials from as recently as 2024.

We would say that leaked login data is always a problem, regardless of if it’s ten years, or ten days old. Besides, many organizations never change their login credentials, or reuse the same passwords across a myriad of other services, in which case such a database could prove a gold mine for brute-force or credential stuffing attacks.

At press time, Oracle has not yet addressed the media reports, but we have contacted the company for comment.

You might also like

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.