Data breach at Oracle may affect hundreds of thousands of businesses

Software giant, Oracle has reportedly been hacked with far-reaching implications for its customers. According to KrebsOnSecurity, the breach affected Oracle's MICROS division, which provides point-of-sale systems and support for many businesses around the world. In fact, the number of locations using MICROS around the world comes in at more than 330,000, spread across 180 different countries.

Brian Krebs says that a Russian cybercrime group has gained access to Oracle’s systems, including the customer portal for businesses that use its credit card processing systems.Oracle confirmed to Krebs that it had “detected and addressed malicious code in certain legacy MICROS systems,” and is telling customers to reset username and passwords.

Kreb informs that his sources found Micros customer service portal communicating with a server owned by the Carbanak Gang, a Russian cybercrime group. Worst-case scenarios would involve malware being uploaded to customers’ POS terminals, which could be used to skim the card details of millions of customers.

Krebs learned about the breach on July 25th but it’s unclear when did Oracle first discover it. It’s thought that the malware started on one device, but subsequently spread to 700+ machines. The infected customer service portal may well not be the end of it.

Point-of-sale based malware has driven most of the credit card hacks over the past two years, including intrusions at Target and Home Depot, as well as breaches at a slew of point-of-sale vendors. The malware usually is installed via hacked remote administration tools. Once the attackers have their malware loaded onto the point-of-sale devices, they can remotely capture data from each card swiped at that cash register.

The news has come at a crucial time for Oracle, which has been struggling to compete with other software giants like Amazon and Google in cloud-based services. Last month, Oracle announced it would pay $9 billion to acquire NetSuite Inc., one of the first cloud-services companies.