Breach hits Oracle’s payment terminal systems
09 Aug 2016
A data breach within its retail unit has hit Oracle. According to the cloud giant, which confirmed the breach in an email to Fortune, it discovered malicious software on systems running its network of Micros payment terminals.
The breach affected not only hundreds of the company's computers, but also an online support portal that allowed Oracle to remotely address customers' issues concerning their cash register-connected terminals, according to Brian Krebs, an independent cybersecurity journalist, who first reported it on his site Krebs on Security yesterday, citing people briefed on the matter.
The malware planted on Oracle's systems allowed hackers to steal customers' login credentials, Krebs said.
In response, Oracle said it was forcing users of the service to change their account passwords, adding that the breach would not affect its other corporate networks, cloud services, and systems.
The Micros system compromise could explain why so many shops, hotels, and retail outlets had suffered breaches at their point of sale systems in the past months, Fortune reported quoted Avivah Litan, an analyst in Gartner.
When asked whether she believed that the breach had something to do with a recent spate of stolen payment card data in retail and hotel hacks, Litan said, ''I think it's very likely.''
In an undated letter shared with the IDG News Service, the Oracle said it had "detected and addressed malicious code in certain legacy Micros systems." According to the letter, payment card data was encrypted "both at rest and in transit" in the Micros system.
Oracle added it had "implemented additional security measures" to prevent a recurrence, but it did not elaborate on what they were. Oracle has called on all Micros customers to change their passwords and the password for any account used by a Micros representative to access the payment system.
