4
Published signals
currently linked to this company
Company intelligence
Oracle cybersecurity incidents and threat signals
oracle.com
This company page brings together public reporting currently associated with Oracle. It reflects signals published by Shadow Tier and should not be read as a complete incident history.
Company links
0
Last 28 days
recent published signals
0
Last 90 days
recent published signals
1
High or critical
confidence classifications
July 22, 2026
Latest report
most recent published signal
Explore related intelligence
Explore this reporting from another angle
Based on all published signals currently linked to Oracle. Affected countries come from victim data; the company country above remains a separate profile fact. Counts describe this reporting set, not overall incident prevalence.
Confirmed impacts
Company signals
All published signals involving Oracle
Oracle Cloud and Oracle Health experience cyber incidents, sensitive data accessed
April 2025 brought even more – and bigger – cybersecurity news stories to note, potentially eclipsing the events seen in March , February and January . This month’s recap by SWK Technologies features an extended look at several top headlines and how they may impact your business, including breaches at Oracle and a financial services regulator, the effect of continuing budget and staff cuts at federal agencies, and attacks against public utilities. Continuing reading below to see the top cybersecurity stories for April and how they may affect you: Oracle Cloud Breaches May Have Exposed Millions of Files Oracle Cloud experienced multiple cyber incidents this year , although the company itself has denied that its greater cloud-based ecosystem is at risk. In an email to customers, Oracle stated “unequivocally” that the OCI (Oracle Cloud Infrastructure), the global network from which its various services are provided from, was itself not compromised and current users should be safe. The attacks ostensibly only affected legacy environments on servers belonging to “Oracle Cloud Classic” and Oracle Health, which are supposedly unconnected to the larger OCI ecosystem. In both of these cases, the hackers breached the ostensibly legacy servers and gained access to significant volumes of data – up to 6 million records from OCC alone – and demanded a ransom from Oracle on the threat of releasing the files publicly, though the FBI is currently investigating at least the Oracle Health incident. Almost simultaneously with this news was the release of hundreds of security patches by Oracle to address several vulnerabilities found in different systems, including some cloud services. Also concurrent with these incidents, several government institutions – including the U.S. Army, Department of Agriculture and The National Gallery of Art – announced contracts for cloud-based services from Oracle, even as such spending comes under scrutiny from the current Trump administration (more on that below). Oracle is a near-ubiquitous provider of technology solutions and services between databases and other software systems as well as their cloud environments, present in many popular digital architectures from coding scripts to ERP platforms. CVE Program for Bug Reporting Avoids Shutdown MITRE’s Common Vulnerabilities and Exposures (CVE) program , the industry standard for tracking and identifying security vulnerabilities, warned it may be at risk of having to cease operations due to a potential expiration of U.S. government funding on April 16, 2025. Professionals around the world working in cybersecurity, IT, software development and more have relied on these CVE warnings for years to quickly identify and address bugs throughout different systems and networks , preventing exploitation of critical applications by bad actors. As the greater infosec community and media panicked over the implications, CISA (Cybersecurity and Infrastructure Security Agency), the main federal agency in charge of cyberspace security, issued an 11-month contract extension for MITRE mere hours before the deadline. Though the ostensible information security apocalypse was narrowly avoided at the almost literal 11 th hour, there remains the real possibility that the CVE program will lose funding within the next few years. CISA continues to be a prime target of spending and job cuts by the Trump administration and DOGE, and the entire process around the budget reduction has been at best confusing (including rehires of fired or laid off personnel ). With accusations against Musk and his team of a fundamental lack of understanding of the cybersecurity demands of government – including a recent whistleblower complaint alleging major negligence – and continuing chaos involving current and former agency staff, it does not seem likely that CISA will survive this current term completely intact, raising the question of who will be in charge of keeping the CVE reporting up and running. MITRE, a nonprofit organization, is itself essentially a legacy holdover from when the Massachusetts Institute of Technology (MIT) spearheaded the program, and observers have already called for others to take over its responsibilities in a more collaborative methodology. However, this raises its own questions about the future of the program if ownership passes from an ostensibly neutral party funded by the U.S. government to other actors with different obligations, especially given the current global political climate. Big Banks Stop Disclosing Info After Regulator Hacked Multiple overlapping cybersecurity news stories wrapped up in one may have sweeping implications for regulation in the industry as several banks react to the fallout of a major breach discovered at the Office of the Comptroller of the Currency (OCC) . Part of the U.S. Treasury Department and responsible for overseeing the national banking system (including both domestic and foreign institutions), the OCC reported in early April 2025 that it had uncovered “a major information security incident” after investigations revealed unauthorized access of over 100 email accounts in its network. Both internal and third-party reviews by cybersecurity experts identified sensitive information contained in the compromised messages, which had been accessed by the hackers within at least a year before being discovered by February 2025. If this incident did not already bring its own wide-reaching implications already, the market reaction just further cemented the severity of the situation, with JPMorgan Chase, the Bank of New York Mellon and Bank of America reportedly “halting” sending information to the OCC . Other banks and credit unions are also reported to be potentially considering responsive action, although these rumors are unconfirmed and the only clear information so far is that Citigroup is continuing to share data under a stricter consent order resulting from a penal decision in 2024 . Though various media outlets indicate that the sharing pause is not total, the response itself creates an interesting precedent within the financial services industry and others. This news comes even as bipartisan efforts try to promote better reporting and data sharing between government and private institutions , highlighting the importance of collaboration and transparency in limiting the damage of cybercrime. April 2025 Data Breaches: 4 Million SSNs Leaked, 23M+ in Settlements Stay up to date with Pomerium news and announcements. You have successfully joined our subscriber list.
Oracle Cloud Data Breach Allegations and Data Sale
A threat actor, 'rose87168', claimed to have exfiltrated 6 million records from Oracle Cloud's Single Sign-On (SSO) and LDAP systems and began selling this data on hacking forums around March 20-21, 2025. The data allegedly included JKS files, encrypted SSO passwords, key files, and enterprise manager JPS keys, potentially impacting over 140,000 Oracle Cloud tenants. While Oracle initially denied a breach of its core cloud infrastructure, subsequent reports indicated private acknowledgments to some customers about a breach affecting older 'legacy environments'.
Oracle Health detects breach of legacy Cerner data migration servers
Oracle Health detected a cybersecurity event on February 20, 2025, involving unauthorized access to legacy Cerner data migration servers. Attackers used compromised customer credentials to gain access sometime after January 22, 2025, and patient data was confirmed to be stolen. The FBI is investigating potential extortion attempts related to the compromised data.
Oracle Health (Cerner) Legacy Server Breach
In a separate incident from the Oracle Cloud breach, Oracle Health (formerly Cerner), a provider of electronic health record (EHR) systems, experienced a data breach. A hacker reportedly used stolen credentials to access legacy servers that had not yet been migrated to Oracle Cloud, leading to the exfiltration of healthcare records from various hospitals in the United States. The incident began on January 22, 2025, and Oracle first noticed the breach on February 20, 2025. The attacker is allegedly extorting Oracle Health customers, demanding cryptocurrency payments to withhold publishing the stolen data, which likely includes protected health information.
FAQ
Questions about Oracle cybersecurity reporting
What does the Oracle page include?
It combines a reviewed organization profile with all current published Shadow Tier signals explicitly linked to Oracle.
Does every mention of Oracle appear here?
No. A signal must contain a reliable company connection and meet the publication criteria; incidental or ambiguous mentions are excluded.
Why can the incident count change?
The page follows current published reporting. Counts change as new evidence is added, classifications are reviewed, or older signals leave the reporting window.