Rahul Sasi

On March 21, 2025, CloudSEK’s XVigil platform flagged a significant threat—a threat actor offering 6 million exfiltrated records from Oracle Cloud for sale. Despite Oracle’s public denial, our deep-dive investigation reveals a compromised production SSO endpoint, affecting over 140,000 tenants and exposing sensitive SSO and LDAP data. Our report outlines verified evidence of the breach. At CloudSEK, we prioritize transparency and preparedness. This detailed follow-up not only challenges initial denials but equips enterprises with actionable steps to assess and secure their environments. Read the full report to uncover the evidence, understand the impact, and strengthen your defenses.

We have learned a lot from this attack and identified a serious security flaw within Atlassian products. Check it here GMT 4.30 PM Dec 6th. We are investigating a targeted cyber attack on CloudSEK. An employee's Jira password was compromised to get access to our confluence pages. Additionally, the attacker has some internal details.