Oracle Health breach compromises patient data at US hospitals

HELLFIRE

https://www.bleepingcomputer.com/news/security/oracle-health-breach-compromises-patient-data-at-us-hospitals/

A breach at Oracle Health impacts multiple US healthcare organizations and hospitals after a threat actor stole patient data from legacy servers. …

What seems new, if true, is this twist

… In conversations with numerous sources, BleepingComputer learned that all formal communication was sent on plain paper rather than Oracle letterhead, nor has the company formerly acknowledged the breach as expected. The notification seen by BleepingComputer was not on official letterhead but was signed by Seema Verma, the Executive Vice President & GM of Oracle Health. Furthermore, rather than providing written reports, Oracle Health has reportedly directed customers to communicate only with its Chief Information Security Office (CISO) over the phone and not via email. …

Regards

GrumpyCanadian

If you weren’t convinced before, this (combined with the other recent not-breach of Oracle Cloud) should be the last bit of proof needed for you to concede that Ellison’s wet dream of having governments store all manner of data on their citizens, DNA samples, biometric data, etc. in a monstrous Oracle database would be one of the worst ideas in the history of computing.

More pedantry: can’t people who are paid to write for a living be bothered to proofread?! Really, “nor has the company formerly acknowledged”? There is a significant difference between “formerly” and “formally”. Oh, divine being, if you exist, take pity on us!

telcodad

GrumpyCanadian More pedantry: can’t people who are paid to write for a living be bothered to proofread?! Really, “nor has the company formerly acknowledged”? There is a significant difference between “formerly” and “formally”.

Yeah, unfortunately for them, a spell checker does not usually pick up those kind of mistakes.

mmmdonuts

Pedantry is racist.

And yeah, uncle Larry is dreaming but if you’ve dealt with Oracle, or any tech services company or IT organization for the last few decades you’d know exactly why quality all around has been in a downward spiral over that time period.

px_eliezer_

mmmdonuts Pedantry is racist.

No.

Just as there should not be errors in computer language, there should not be errors in human language.

Neither of those statements is racist.

“Formerly” and “formally” may sound somewhat the same, but have very different meanings.

Another example is the confusion between “wary” and “weary”, these are different words that are losing their precision because many people fail to differentiate.

GrumpyCanadian

telcodad Right; that’s the point of reading or having an editor on staff to ensure the content is worthy of publication before doing so. It’s almost like nobody cares about the quality of their work anymore and/or nobody takes pride in doing a job well.

broknsymetry

GrumpyCanadian It’s almost like nobody cares about the quality of their work anymore and/or nobody takes pride in doing a job well.

It doesn’t much matter anymore since most youngins can’t read beyond an elementary level anyway. When I was in school, back in the dark ages, spelling and grammar ended after the sixth grade.

Rook

broknsymetry since most youngins…

Aren’t you like 16 years old or something? 🤨 😆

broknsymetry

I’m old for my years. 🙂

mmmdonuts

GrumpyCanadian
Expecting pride in work and a job well done is racist.

HELLFIRE

https://www.theregister.com/2025/03/30/infosec_news_in_brief/ – Oracle Health reportedly warns of info leak from legacy server

Infosec in brief Oracle Health appears to have fallen victim to an info stealing attack that has led to patient data stored by American hospitals being plundered. Oracle Health was formed when Big Red acquired healthcare tech biz Cerner in 2022 for $28.3 billion. According to a letter reportedly sent to customers, Oracle Health advised that unknown actors used stolen customer credentials to break into its cloudy systems and download data, some of which may be information on patients. “We are writing to inform you that, on or around February 20, 2025, we became aware of a cybersecurity event involving unauthorized access to some amount of your Cerner data that was on an old legacy server not yet migrated to the Oracle Cloud,” reads a notification sent to impacted Oracle Health customers, as reported by Bleeping Computer. A Bloomberg report claims the FBI is investigating the possibility of ransom demands. We’ve asked Oracle for comment on the allegation, and details of the incident.

…waiting for the defecation to hit the rotating ventilation. 🙄 🙄 🙄

Regards

HELLFIRE

https://www.theregister.com/2025/03/31/oracle_reported_breaches/ – Oracle Cloud security SNAFU latest: IT giant accused of pedantry as evidence scrubbed. 1990s incident response in 2025

Two Oracle data security breaches have been reported in the past week, and the database goliath not only remains reluctant to acknowledge the disasters publicly – it may be scrubbing the web of evidence, too. … The break-in, according to Orca Security as well as CloudSEK, involved the abuse of CVE-2021-35587, an “easily exploitable vulnerability [that] allows [an] unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.” A fix for that bug was released by the tech giant in early 2022. Thus it’s claimed Oracle didn’t patch a known years-old hole in its own public-facing middleware on its own production SSO servers for its own cloud service, allowing someone to swoop in and grab sensitive customer data. … According to Reuters, the FBI is investigating the incident. Asked on Monday to comment, Oracle has yet to respond.

Here come the lawsuits…
Today, Oracle was sued [PDF] for negligence and breach of contract over its alleged failure to properly secure its systems and to notify customers in a timely manner. The federal-level lawsuit, filed in west Texas, seeks class action status, and targets both the Cloud and Health reported security breaches. It demands damages, costs, and promises from Oracle to better protect its customers, data, and computers. … Infosec expert Kevin Beaumont also chided Oracle for trying to duck responsibility for the alleged Oracle Cloud breach, noting the firm appears to be splitting hairs by drawing a distinction between Oracle Cloud and Oracle Cloud Classic. That is to say, the US super-corp claims Oracle Cloud was not infiltrated, though that leaves the door open to Oracle Cloud Classic being the specific product that was compromised. A distinction without a difference: Part of Oracle’s public cloud offering was broken into, according to rose87168 and others. … Beaumont and Jake Williams, another security researcher, both alleged Oracle appears to have used the Internet Wayback Machine’s archive exclusion process to scrub evidence of the intrusion. …

…this an “Ooops!” or an “Oh S**T!” moment? Asking for a friend…

Regards

HELLFIRE

https://www.theregister.com/2025/04/02/oracle_breach_class_action/ – Oracle faces Texas-sized lawsuit over alleged cloud snafu and radio silence
https://storage.courtlistener.com/recap/gov.uscourts.txwd.1172831612/gov.uscourts.txwd.1172831612.1.0.pdf

Specialist class action lawyers have launched proceedings against Oracle in Texas over two alleged data breaches. Floridian Michael Toikach is the named plaintiff in law firm Shamis & Gentile’s class action against the cloud giant, which is seeking to represent others who are similarly affected. Lawyers demanded a jury trial in the US District Court for the Western District of Texas, where Oracle’s headquarters are located in Austin. One of the primary claims made by the plaintiffs, among many others, is that Oracle violated Texas state data breach notification laws in not informing the alleged victims of a breach within 60 days of becoming aware of one. … Oracle’s alleged security failings were blamed for the loss of personally identifiable information (PII) and a “wide variety” of personal health data, and Oracle’s silence on the matter exacerbates these claims, the case argues. Toikach alleges that Oracle has not yet informed him or other customers of a breach, clarified whether it was able to maintain the security of his data, or explained how the alleged incident occurred. …

https://www.theregister.com/2025/04/02/oracle_breach_disaster_planning/ – Oracle’s masterclass in breach comms: Deny, deflect, repeat. Fallout shows how what you say must be central to disaster planning

Opinion Oracle is being accused of poor incident comms as it reels from two reported data security mishaps over the past fortnight, amid a reluctance to publicly acknowledge all of the events as well as allegedly deleting evidence from the web. … Denial and potentially deception and destruction. We rarely get all three when it comes to bad breach disclosures, and these can turn what should be a routine comms exercise into a veritable PR disaster. … There have been some disclosure stinkers in the past. Back in 2016, The Reg discovered that Yahoo! had taken a few years to disclose security snafus that occured in 2013 and 2014, for example. These days we often see organizations simply choose not to publicly address their issues. pb[A quick self-referral to the regulators and some letters sent directly to those affected pass as the bare minimum, and while these organizations won’t get any Brownie points for transparency, the approach doesn’t tend to invite too much in the way of long-lasting criticism either.[/b] … Infoseccer Beaumont, aka “GossiTheDog”, later pointed out that he believed Oracle was trying to, in his words, “wordsmith” its statements in specific ways to avoid responsibility. Beaumont noted that Oracle distinguishes Oracle Cloud from Oracle Cloud Classic, and claimed the breach likely stemmed from the latter. … All things considered, Oracle’s response might go down as one of the all-time lows in the genre. …

Regards

vaxvms

Oracle says its cloud was in fact compromised
Reliability, honesty, accuracy. And then there’s this lot
https://www.theregister.com/2025/04/08/oracle_cloud_compromised/?td=rt-3a

Oracle has briefed some customers about a successful intrusion into its public cloud, as well as the theft of their data, after previously denying it had been compromised.

The Safra Catz-run database giant swore blind the claims were false. It turns out the only thing false were the denials.

In the US, there’s no federal security breach reporting requirement, though various states require swift disclosure. Meanwhile, if Oracle’s Health platforms have been raided as feared, it could be fined under the Health Insurance Portability and Accountability Act, aka HIPAA.

GrumpyCanadian

vaxvms no federal security breach reporting requirement

That’s good to know. I was under the impression that there was such a requirement.

HELLFIRE

Welp, the defecation hit the rotating ventilation…. so this still an “ooops!” moment or an “oh S**T!” moment?

Pop the popcorn and chill the beer, same d**n floorshow, but I’ll still watch…

/sarcasm

Regards

HELLFIRE

https://www.bleepingcomputer.com/news/security/oracle-says-obsolete-servers-hacked-denies-cloud-breach/ – Oracle says “obsolete servers” hacked, denies cloud breach

Oracle finally confirmed in email notifications sent to customers that a hacker stole and leaked credentials that were stolen from what it described as “two obsolete servers.” However, the company added that its Oracle Cloud servers were not compromised, and this incident did not impact customer data and cloud services. “Oracle would like to state unequivocally that the Oracle Cloud—also known as Oracle Cloud Infrastructure or OCI—has NOT experienced a security breach,” Oracle says in a customer notification shared with BleepingComputer. “No OCI customer environment has been penetrated. No OCI customer data has been viewed or stolen. No OCI service has been interrupted or compromised in any way,” it added in emails sent from replies@oracle-mail.com, prompting customers to contact Oracle Support or their account manager if they have additional questions. “A hacker did access and publish user names from two obsolete servers that were never a part of OCI. The hacker did not expose usable passwords because the passwords on those two servers were either encrypted and/or hashed. Therefore the hacker was not able to access any customer environments or customer data.” Since the incident surfaced in March, when a threat actor (rose87168) put up 6 million data records for sale on BreachForums, Oracle has consistently denied reports of an Oracle Cloud breach in statements shared with the press. While this is admittedly true as it matches what Oracle is telling customers—that the breach impacted an older platform, Oracle Cloud Classic—this is merely wordsmithing, as cybersecurity expert Kevin Beaumont said.

Regards

vaxvms

The Reg translates the letter in which Oracle kinda-sorta tells customers it was pwned
TL;DR: Move along, still nothing to see here - an idea that leaves infosec pros aghast

Oracle’s letter to customers about an intrusion into part of its public cloud empire - while insisting Oracle Cloud Infrastructure was untouched - has sparked a mix of ridicule and outrage in the infosec community.

The memo is now public and, since decoding corporate messaging is part of the job for any Register vulture, we’ve decided to present the letter in full, with translations-slash-annotations to make sense of it.

Read and chuckle (or shake your head)

Rook

I believe this is the link: The Reg translates the letter in which Oracle kinda-sorta tells customers it was pwned

HELLFIRE

Rook I believe this is the link:

Well, this does sound better than “Dear sheep waiting to get shorn.”

XD XD TheRegister took the knife, buried it deep and is twisting XD XD

Regards