Skip to content
Breach Index · running record

Oracle data breach timeline: Oracle Cloud, Oracle Health and the E-Business Suite zero-day

Searches for “Oracle data breach” mix up three different 2025 events: a claimed theft of Oracle Cloud login data that Oracle publicly denied, a confirmed theft of patient data from legacy Oracle Health (Cerner) servers, and a Cl0p extortion campaign against customers’ own Oracle E-Business Suite systems. This page separates them, with the source for each.

Short answer

Was Oracle hacked?

Yes, in two different ways, and a third campaign hit Oracle customers rather than Oracle. In early 2025 Oracle Health notified hospital customers that someone accessed patient data on legacy Cerner servers not yet moved to Oracle Cloud; Oracle said it became aware of it around 20 February 2025, and a Texas Attorney General filing reported in October 2026 puts the number of people at nearly 20 million.

Separately, a hacker using the name rose87168 claimed in March 2025 to hold login data for about 6 million Oracle Cloud records. Oracle publicly said “There has been no breach of Oracle Cloud,” then, per Bloomberg and BleepingComputer, told some customers that an attacker had accessed two obsolete servers in a legacy environment. In October 2025, Cl0p exploited a zero-day in customer-run Oracle E-Business Suite (CVE-2025-61882) to steal data and extort companies; Oracle issued an emergency patch on 4 October.

Timeline at a glance

  1. ~22 Jan 2025Attackers access legacy Cerner (Oracle Health) servers with stolen customer credentials. (eSecurity Planet)Reported
  2. ~20 Feb 2025Oracle Health becomes aware; notifies hospital customers in March. (TechCrunch (Oracle notice))Confirmed
  3. Mar 2025rose87168 claims ~6M Oracle Cloud SSO/LDAP records; Oracle denies a breach of Oracle Cloud. (TechCrunch)Reported
  4. Apr 2025Oracle privately tells customers two obsolete legacy servers were accessed. (BleepingComputer)Reported
  5. 4 Oct 2025Oracle Security Alert for E-Business Suite CVE-2025-61882, exploited by Cl0p since about August. (Oracle)Confirmed
  6. Oct 2026Texas AG filing: Oracle Health breach affected nearly 20 million people. (eSecurity Planet (Bloomberg))Reported

Last updated October 30, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Oracle incident timeline, in detail

Confirmed = acknowledged by Oracle, a regulator filing or a court. Reported = credible reporting Oracle has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Jan – Mar 2025ConfirmedHealthcare data / legacy migration servers

Oracle Health: patient data taken from legacy Cerner servers

What happened. Oracle Health’s notice to hospital customers says it became aware of a cybersecurity event on or around 20 February 2025 involving “unauthorized access to some amount of your Cerner data” on a legacy server not yet migrated to Oracle Cloud. Reporting says attackers used compromised customer credentials, that access began around 22 January, and that hospitals were extorted.

Impact. Patient data held for Oracle Health’s hospital customers. A Texas Attorney General filing, reported by Bloomberg in October 2026, puts the total at nearly 20 million people. Oracle did not publish its own figure.

Sources: TechCrunch, 31 Mar 2025 · eSecurity Planet, Oct 2026

Mar – Apr 2025ReportedIdentity infrastructure / disputed

“Oracle Cloud” login data claim: public denial, private admission about legacy servers

What happened. rose87168 offered data said to come from Oracle Cloud single sign-on and LDAP systems, about 6 million records including encrypted passwords, and uploaded a text file bearing that handle to an Oracle Cloud-hosted server as proof. Several Oracle customers told BleepingComputer the samples looked genuine. Oracle said: “There has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud.” In April, Bloomberg and BleepingComputer reported Oracle telling some customers that an attacker had accessed two obsolete servers in a legacy environment and taken old client credentials.

Impact. Disputed. Oracle’s position is that Oracle Cloud Infrastructure was not breached; critics argue the legacy servers were still Oracle-run cloud login systems.

Sources: TechCrunch, 31 Mar 2025 · BleepingComputer, Apr 2025 · CSO Online

Aug – Oct 2025ConfirmedProduct zero-day / customer-run software

Cl0p exploits an Oracle E-Business Suite zero-day to extort customers

What happened. Oracle issued an out-of-cycle Security Alert on 4 October 2025 for CVE-2025-61882, a remotely exploitable, unauthenticated flaw in E-Business Suite 12.2.3–12.2.14. Google’s threat-intelligence team said it was exploited as a zero-day as early as 9 August 2025, and that from 29 September extortion emails claiming to be from Cl0p were sent to executives at numerous organisations. Oracle patched a related flaw, CVE-2025-61884, on 11 October.

Impact. Data stolen from customers’ own EBS systems, not from Oracle’s. Victim counts in reporting range from dozens to more than 100 organisations.

Sources: Oracle Security Alert CVE-2025-61882 · Google Threat Intelligence · Help Net Security, 6 Oct 2025

Where the reports disagree

  • Oracle Cloud: Oracle publicly denied any breach of Oracle Cloud, while customers validated the attacker’s samples and Oracle later privately described a breach of “obsolete” legacy servers. Whether that counts as “Oracle Cloud” depends on how you define the legacy service.
  • Oracle Health scale: Oracle has not published a total. The nearly-20-million figure comes from a Texas AG filing as reported by Bloomberg.
  • Linked or not? The Oracle Health and Oracle Cloud incidents were reported in the same weeks; no public evidence establishes they were the same actor.
  • E-Business Suite: Oracle initially pointed customers to July 2025 patches; Google and others say CVE-2025-61882 was exploited as a zero-day before any patch existed.

The pattern across the record

Legacy systems mid-migration

Two of the three incidents hit systems Oracle described as legacy or not yet migrated. Old estates awaiting migration keep real data while losing attention.

Denial language became the story

The gap between “no breach of Oracle Cloud” and the private customer notices did more reputational damage than the data itself. Precise, early disclosure would have been cheaper.

What it means for Oracle customers — and what to do

Which incident matters to you depends on which Oracle product you use. Each has a different action.

  1. 1.Oracle Health / Cerner customers: get your patient list

    Ask Oracle Health for the list of affected patients and notification responsibilities; hospitals have to notify under HIPAA even when the vendor was breached.

    Notification clocks
  2. 2.Legacy Oracle Cloud (Classic) tenants: rotate credentials

    Reset passwords and keys for accounts tied to legacy Oracle Cloud login services, and check SSO/LDAP integrations.

    Leaked credential response
  3. 3.E-Business Suite owners: patch and hunt

    Apply the CVE-2025-61882 and CVE-2025-61884 fixes, keep EBS off the open internet, and look for signs of compromise from August 2025 onward.

  4. 4.Ask vendors for straight answers

    Put a duty to disclose incidents affecting your data, in plain terms and on a fixed clock, in the contract.

    Contract clause library

CISO takeaways

Handle a vendor that denies

Plan what you do when the vendor says no breach and the evidence says otherwise.

Third-party breach intake
Practise a ransomware-extortion call

Cl0p skips encryption and goes straight to extortion. Rehearse that.

Ransomware tool
Track legacy systems as risks

Give every not-yet-migrated system an owner and an end date.

Risk Register
Rotate credentials safely

Verify the new secret before revoking the old one.

Leaked credential response

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed October 30, 2026.

  1. 1.Oracle under fire for its handling of separate security incidents — TechCrunch, 31 Mar 2025
  2. 2.Oracle privately confirms cloud breach to customers — BleepingComputer, Apr 2025
  3. 3.Oracle admits breach of “obsolete servers,” denies main cloud platform affected — CSO Online, Apr 2025
  4. 4.Security Alert CVE-2025-61882 — Oracle, 4 Oct 2025
  5. 5.Oracle E-Business Suite zero-day exploited in widespread extortion campaign — Google Threat Intelligence Group, Oct 2025
  6. 6.Cl0p exploits Oracle E-Business Suite zero-day (CVE-2025-61882) — Help Net Security, 6 Oct 2025
  7. 7.Texas AG says Oracle Health’s 2025 breach affected 20M individuals — eSecurity Planet (citing Bloomberg), Oct 2026

Frequently asked questions

Was Oracle hacked?

Yes. Oracle Health confirmed to hospital customers that patient data was accessed on legacy Cerner servers in early 2025, and Oracle reportedly told some customers that two obsolete legacy cloud login servers were accessed. Oracle publicly denied that Oracle Cloud itself was breached. A third 2025 campaign, by Cl0p, exploited a flaw in customers’ own Oracle E-Business Suite systems.

How many people were affected by the Oracle Health data breach?

A Texas Attorney General filing, reported by Bloomberg in October 2026, puts it at nearly 20 million people. Oracle has not published its own total.

Did Oracle admit the Oracle Cloud breach?

Publicly, Oracle said there was no breach of Oracle Cloud. According to Bloomberg and BleepingComputer, it privately told some customers in April 2025 that an attacker accessed two obsolete servers in a legacy environment and took old client credentials.

What is CVE-2025-61882?

A critical, unauthenticated remote flaw in Oracle E-Business Suite 12.2.3–12.2.14. Oracle issued an emergency Security Alert on 4 October 2025; Google says Cl0p exploited it from about August 2025 to steal data and extort companies.

Are the Oracle Health and Oracle Cloud incidents the same breach?

They are reported as separate incidents. No public evidence shows they were carried out by the same actor.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Salesforce data breachTechnology

Vishing and stolen OAuth tokens across customer tenants.

Workday data breachTechnology

A third-party CRM, business contacts, no tenant access.

Red Hat data breachTechnology

A consulting GitLab and claimed client engagement reports.

Ingram Micro data breachTechnology

Ransomware outage and 42,521 staff and applicants.

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Oracle. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.

🎉 New here? Use code WELCOME10 for 10% off any plan at checkout