4 ms·

>BleepingComputer has confirmed with multiple companies that associated data samples shared by the threat actor are valid. >In addition to the data, rose87168

>BleepingComputer has confirmed with multiple companies that associated data samples shared by the threat actor are valid. >In addition to the data, rose87168 shared an Archive.org URL with BleepingComputer for a text file hosted on the "login.us2.oraclecloud.com" server that contained their email address. This file indicates that the threat actor could create files on Oracle's server, indicating an actual breach. Oracle probably should have just admitted the validity up front. It's not like there are any real penalties to a breach. Lying about it is probably a worse PR hit than the breach itself.

znpy 2y ago
> It's not like there are any real penalties to a breach. Not in the US maybe. In the EU under GDPR you have to disclose within 48h of you realizing (or made aware of) the breach. There are fines (at least) if you don't disclose it afaik. Oracle is gonna have issue with the EU, most likely.
- ziddoap 2y ago
  Have their been any GDPR fines that amount to more than a rounding error of Oracle's revenue? Admittedly, I don't watch too closely, but from the ones I am aware of, I haven't seen any GDPR fines that made me finally think "wow, that might actually count as a punishment". (I would honestly be happy to learn of some!) There are disclosure laws in the US as well, but again, the fines are like a days worth of revenue. Maybe the breached company has to provide a year of credit monitoring for the affected persons, if lucky.
  - mikeyouse 2y ago
    Several of the fines have been in the hundreds of millions of dollars - and while not crushing to Oracle, that's actual money that will definitely change behavior.. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
    - ziddoap 2y ago
      Nice, thanks for the link! The largest fine ever issued is about 2% of Oracle's 2024 revenue. If we average the top 5 fines ever issued (this breach surely wont result in the largest GDPR fine ever), it'd be about 1% of Oracle's 2024 revenue. So, between ~3.5 and ~7 days worth of revenue, if we're lucky and get a top 5 GDPR fine? I'm not sure that is in the "definitely change behavior" area yet (in fact, I'm confident it is not), but better than I thought.
      - piva00 2y ago
        7 days of revenue, 1 whole week out of 52 that all of your workforce production went to pay a fine? Yeah, that's quite noticeable for a corporation.
        ziddoap 2y ago
        If this breach receives a fine in the top 5 fines ever issued in the entire history of GDPR enforcement. Don't forget to subtract out the money they saved from reduced investment in security over that time, as well. Noticeable? Sure. Nowhere near noticeable enough, though, in my opinion. Especially if we're serious about it and recognize this isn't going to be a top 5 fine.
        fc417fc802 2y ago
        Presumably if it's due to negligence (ie intentional lack of investment) it will happen again if the underlying issue isn't fixed. So you have to factor that in. If it happens repeatedly presumably the percentage will go up. I think the only way this gets written off is if saving the money opens you up to such a low level of additional risk that you don't reasonably expect the event to happen more than once (if ever). But if the risk level is actually that low (I don't believe this to be the case, just playing out a hypothetical here) then arguably they wouldn't be in the wrong. To put this in regular person terms, 3% of a 6 figure salary is $3k. That's more than enough to get most people's attention.
        gtirloni 2y ago
  - everfrustrated 2y ago
    In the UK, and I presume the EU also, the fines for losing customer data are set as a % of company annual worldwide turnover. https://ico.org.uk/for-organisations/law-enforcement/guide-to-le-processing/penalties/#ib1 https://ico.org.uk/for-organisations/law-enforcement/guide-t...
    - ziddoap 2y ago
      According to the GDPR enforcement tracker link helpfully provided by the sibling commenter, we'll be lucky to see a ~1% fine of the 2024 revenue of Oracle. That's assuming that the fine issued is in the top 5 GDPR fines ever issued. Even 4%, the cited higher maximum on your link, is kind of peanuts (not sure this breach would even qualify for the "higher maximum", as I'm unfamiliar with the laws, so it could be a maximum of 2% if counted as a "standard maximum"). To me, that's still in the "cost of doing business" territory, not the "punishment" territory.
      - smueller1234 2y ago
        4% of revenue is terrifying for large corporations.
        nukem222 2y ago
        It's impossible to take their fears seriously—literally any kind of social obligation is going to be scary for an entity with no desire to do anything but feed its owners. Wait until you see what kind of reaction 40% gets! Existential threats will be the only things that work.
        ziddoap 2y ago
        Have they ever issued a fine for 4% of revenue? That's the maximum fine possible, under the non-standard "higher maximum" category. This breach surely won't be given the maximum considering there isn't really anything noteworthy about it. We should consider the maximum that has actually been issued, than subtract some off of that. You also have to subtract out all of the money they saved over the years of reduced investment into security. I think that lands us squarely back into "cost of doing business" land.
  - znpy 2y ago
    > Have their been any GDPR fines that amount to more than a rounding error of Oracle's revenue? Not yet, hopefully soon: under some circumstances GDPR fines can go up to 6% of gross earning (ebitda) iirc.
- toomuchtodo 2y ago
  SEC Fact Sheet: Public Company Cybersecurity Disclosures; Final Rules - https://www.sec.gov/files/33-11216-fact-sheet.pdf https://www.sec.gov/files/33-11216-fact-sheet.pdf
  - rodgerd 2y ago
    I mean it's true that there's a rule, but at this point in US history I think we have reason to be sceptical that it will be enforced.
    - toomuchtodo 2y ago
      The SEC selectively enforcing the rule does not prohibit a shareholder suit against the company. "Everything Everywhere Is Securities Fraud" after all.
      - devman0 2y ago
        Additionally, while not specific to this SEC enforcement action, corporations also have to think long term, just because this administration is not enforcing laws, doesn't mean the next one can't reach back and do so, the laws are still on the books after all.
- mrbluecoat 2y ago
  Maybe the EU wasn't on the Signal group chat when Oracle notified The Atlantic of the breach
  - cyanydeez 2y ago
    [flagged]
- miksik 2y ago
  > In the EU under GDPR you have to disclose within 48h 72h actually, but yes, data protection and breaches to sensitive personal information is taken very seriously in the European Union and its legislation.
m3047 2y ago
This just in... /s Seriously though, Sullivan lost his appeal. You should have read up on this. https://www.courthousenews.com/wp-content/uploads/2025/03/usa-v-joseph-sullivan-ninth-circuit-ruling.pdf https://www.courthousenews.com/wp-content/uploads/2025/03/us...
- ziddoap 2y ago
  What exactly is the point you are trying to make? He got in trouble for obstruction of justice and misprison of felony for trying to cover up a breach. Not because there was a breach. There are basically no punishments for a breach itself. But yes, if you obstruct authorities who investigate, you can get in trouble.

znpy 2y ago

> It's not like there are any real penalties to a breach. Not in the US maybe. In the EU under GDPR you have to disclose within 48h of you realizing (or made aware of) the breach. There are fines (at least) if you don't disclose it afaik. Oracle is gonna have issue with the EU, most likely.

ziddoap 2y ago
Have their been any GDPR fines that amount to more than a rounding error of Oracle's revenue? Admittedly, I don't watch too closely, but from the ones I am aware of, I haven't seen any GDPR fines that made me finally think "wow, that might actually count as a punishment". (I would honestly be happy to learn of some!) There are disclosure laws in the US as well, but again, the fines are like a days worth of revenue. Maybe the breached company has to provide a year of credit monitoring for the affected persons, if lucky.
- mikeyouse 2y ago
  Several of the fines have been in the hundreds of millions of dollars - and while not crushing to Oracle, that's actual money that will definitely change behavior.. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
  - ziddoap 2y ago
    Nice, thanks for the link! The largest fine ever issued is about 2% of Oracle's 2024 revenue. If we average the top 5 fines ever issued (this breach surely wont result in the largest GDPR fine ever), it'd be about 1% of Oracle's 2024 revenue. So, between ~3.5 and ~7 days worth of revenue, if we're lucky and get a top 5 GDPR fine? I'm not sure that is in the "definitely change behavior" area yet (in fact, I'm confident it is not), but better than I thought.
    - piva00 2y ago
      7 days of revenue, 1 whole week out of 52 that all of your workforce production went to pay a fine? Yeah, that's quite noticeable for a corporation.
      - ziddoap 2y ago
        If this breach receives a fine in the top 5 fines ever issued in the entire history of GDPR enforcement. Don't forget to subtract out the money they saved from reduced investment in security over that time, as well. Noticeable? Sure. Nowhere near noticeable enough, though, in my opinion. Especially if we're serious about it and recognize this isn't going to be a top 5 fine.
        fc417fc802 2y ago
        Presumably if it's due to negligence (ie intentional lack of investment) it will happen again if the underlying issue isn't fixed. So you have to factor that in. If it happens repeatedly presumably the percentage will go up. I think the only way this gets written off is if saving the money opens you up to such a low level of additional risk that you don't reasonably expect the event to happen more than once (if ever). But if the risk level is actually that low (I don't believe this to be the case, just playing out a hypothetical here) then arguably they wouldn't be in the wrong. To put this in regular person terms, 3% of a 6 figure salary is $3k. That's more than enough to get most people's attention.
        gtirloni 2y ago
- everfrustrated 2y ago
  In the UK, and I presume the EU also, the fines for losing customer data are set as a % of company annual worldwide turnover. https://ico.org.uk/for-organisations/law-enforcement/guide-to-le-processing/penalties/#ib1 https://ico.org.uk/for-organisations/law-enforcement/guide-t...
  - ziddoap 2y ago
    According to the GDPR enforcement tracker link helpfully provided by the sibling commenter, we'll be lucky to see a ~1% fine of the 2024 revenue of Oracle. That's assuming that the fine issued is in the top 5 GDPR fines ever issued. Even 4%, the cited higher maximum on your link, is kind of peanuts (not sure this breach would even qualify for the "higher maximum", as I'm unfamiliar with the laws, so it could be a maximum of 2% if counted as a "standard maximum"). To me, that's still in the "cost of doing business" territory, not the "punishment" territory.
    - smueller1234 2y ago
      4% of revenue is terrifying for large corporations.
      - nukem222 2y ago
        It's impossible to take their fears seriously—literally any kind of social obligation is going to be scary for an entity with no desire to do anything but feed its owners. Wait until you see what kind of reaction 40% gets! Existential threats will be the only things that work.
      - ziddoap 2y ago
        Have they ever issued a fine for 4% of revenue? That's the maximum fine possible, under the non-standard "higher maximum" category. This breach surely won't be given the maximum considering there isn't really anything noteworthy about it. We should consider the maximum that has actually been issued, than subtract some off of that. You also have to subtract out all of the money they saved over the years of reduced investment into security. I think that lands us squarely back into "cost of doing business" land.
- znpy 2y ago
  > Have their been any GDPR fines that amount to more than a rounding error of Oracle's revenue? Not yet, hopefully soon: under some circumstances GDPR fines can go up to 6% of gross earning (ebitda) iirc.
toomuchtodo 2y ago
SEC Fact Sheet: Public Company Cybersecurity Disclosures; Final Rules - https://www.sec.gov/files/33-11216-fact-sheet.pdf https://www.sec.gov/files/33-11216-fact-sheet.pdf
- rodgerd 2y ago
  I mean it's true that there's a rule, but at this point in US history I think we have reason to be sceptical that it will be enforced.
  - toomuchtodo 2y ago
    The SEC selectively enforcing the rule does not prohibit a shareholder suit against the company. "Everything Everywhere Is Securities Fraud" after all.
    - devman0 2y ago
      Additionally, while not specific to this SEC enforcement action, corporations also have to think long term, just because this administration is not enforcing laws, doesn't mean the next one can't reach back and do so, the laws are still on the books after all.
mrbluecoat 2y ago
Maybe the EU wasn't on the Signal group chat when Oracle notified The Atlantic of the breach
- cyanydeez 2y ago
  [flagged]
miksik 2y ago
> In the EU under GDPR you have to disclose within 48h 72h actually, but yes, data protection and breaches to sensitive personal information is taken very seriously in the European Union and its legislation.

m3047 2y ago

This just in... /s Seriously though, Sullivan lost his appeal. You should have read up on this. https://www.courthousenews.com/wp-content/uploads/2025/03/usa-v-joseph-sullivan-ninth-circuit-ruling.pdf https://www.courthousenews.com/wp-content/uploads/2025/03/us...

ziddoap 2y ago
What exactly is the point you are trying to make? He got in trouble for obstruction of justice and misprison of felony for trying to cover up a breach. Not because there was a breach. There are basically no punishments for a breach itself. But yes, if you obstruct authorities who investigate, you can get in trouble.