[Security](https://leakly.com/security/)

[Corroborated][Archive]

# Oracle breach claims vs. Oracle’s denial, via @BleepinComputer — corroborated

Later reporting documented a legacy-server incident and customer notifications, while OCI scope and the attacker’s totals remained disputed.

Leaked on 20 March 2025

![Original Leakly terminal-style archive card: Oracle breach claims vs. Oracle’s denial, via @BleepinComputer — corroborated](https://leakly.com/assets/og/oracle-cloud-denial.png)

An attacker’s claim of an Oracle cloud breach met an unusually categorical denial in March 2025. The public allegation emerged on 20 March, according to subsequent reporting by [The Register](https://www.theregister.com/2025/04/08/oracle_cloud_compromised/) and [SecurityWeek](https://www.securityweek.com/oracle-denies-cloud-breach-after-hacker-offers-to-sell-data/). By the following day, Oracle was telling reporters that Oracle Cloud had not been breached and its customers had not lost data.

> **BleepingComputer** @BleepinComputer
>
> Oracle denies breach after hacker claims theft of 6 million data records - @serghei
> https://t.co/CbXVn4OZOn
> https://t.co/CbXVn4OZOn
>
> 170 likes · 69 reposts · counts as of 09 Nov 2026, 01:46 UTC
>
> — BleepingComputer (@BleepinComputer) [March 21, 2025](https://twitter.com/BleepinComputer/status/1903185877695594557)

not in our leaker index

The attacker’s advertised totals were claims, not an audited count of affected organizations. The important development came when security researchers and customers began examining information they said matched real environments. [TechCrunch](https://techcrunch.com/2025/03/31/oracle-under-fire-for-its-handling-of-separate-security-incidents/) covered the growing dispute while also distinguishing it from a separate Oracle Health incident. Combining those two incidents would have produced a bigger, but misleading, story.

Later coverage narrowed the disagreement. [SecurityWeek](https://www.securityweek.com/cisa-issues-guidance-after-oracle-cloud-hack/) and The Register reported customer notifications and Oracle’s explanation that older servers, rather than Oracle Cloud Infrastructure, had been affected. SecurityWeek also covered guidance from the US cybersecurity agency CISA. That is stronger evidence of a real legacy-system incident than the original sales pitch, while leaving important questions about scope unresolved.

The corroborated badge here is deliberately narrower than a verdict on every allegation. It reflects the evidence for an exposure and the subsequent notifications. It does not endorse the attacker’s full numbers, prove a particular intrusion path, or establish a compromise of every Oracle cloud product. The distinction between a provider’s product names and what customers reasonably understand by cloud security is part of why the denial attracted scrutiny.

This retrospective reports on the coverage only. It contains no stolen records, working credentials, sample data, attacker contact details or links to criminal marketplaces. The useful public-interest question is how a vendor communicates an incident as evidence develops. An initial denial should be weighed against later evidence, not treated as either an automatic debunking or proof that every attacker claim is true.

[Corroborated]

## What happened later

Later reporting documented a legacy-server incident and customer notifications, while OCI scope and the attacker’s totals remained disputed.

## Source note

We could not retrieve BleepingComputer’s original report. This account relies on TechCrunch, The Register and SecurityWeek; the breach’s full scope remains disputed.

## Sources

* [Original X post by @BleepinComputer](https://x.com/BleepinComputer/status/1903185877695594557)
* [TechCrunch — Oracle under fire for its handling of separate security incidents](https://techcrunch.com/2025/03/31/oracle-under-fire-for-its-handling-of-separate-security-incidents/)
* [SecurityWeek — Oracle Denies Cloud Breach After Hacker Offers to Sell Data](https://www.securityweek.com/oracle-denies-cloud-breach-after-hacker-offers-to-sell-data/)
* [The Register — Oracle tells customers its public cloud was compromised](https://www.theregister.com/2025/04/08/oracle_cloud_compromised/)
* [SecurityWeek — CISA Issues Guidance After Oracle Cloud Hack](https://www.securityweek.com/cisa-issues-guidance-after-oracle-cloud-hack/)

[Status definitions](https://leakly.com/editorial-guidelines/#status) · [Corrections](https://leakly.com/corrections/) · [Contact](https://leakly.com/contact/)