What we currently know, 03/24/2025
There has been recent activity around a potential Oracle Cloud breach. Samples of allegedly stolen info from Oracle Cloud are open for sale, touting 6 million records extracted. This data appeared on March 21, 2025, with the threat actor claiming to have gained access by hacking the login endpoint. The data posted includes Java Keystore (JKS) files, encrypted SSO passwords, key files, and enterprise manager Java Process Status (JPS) keys.
Clearwater is actively monitoring this supply-chain threat and assessing all updates on this situation. As of this post, Oracle denies any compromise.
Our recommendation is to take precautions against any leaked passwords with the following actions:
- For all users, ensure the passwords, keys, secrets, and hash values associated with Oracle Cloud Apps are immediately changed
- Update all SSO and LDAP integrations
- Enable MFA to access all Oracle Cloud Apps
Below, you can check if your organization’s web or email domain has been compromised using a tool developed by Clearwater’s Managed Security Services team.
We will continue monitoring the situation and post updates to this page as new information becomes available. If your organization’s web or email domain is compromised, or if you need immediate help assessing this potential risk, feel free to contact us.
