Careers

Experiences

Industries

Offices

Our Firm

Pages

Our People

Updates

Practices

Warner Norcross + Judd LLP is a corporate law firm with over 230 attorneys serving clients in nine offices throughout Michigan. Among the largest law firms in Michigan, Warner works in virtually all areas of business law.

Michigan Law Firm - Warner Norcross + Judd LLP

Recent reports concerning a potential security incident involving Oracle Cloud services provide a warning for many companies who allow third parties to access or store sensitive company data. A threat actor claims to have exfiltrated six million records from Oracle's Single Sign-On (SSO) and Lightweight Directory Access Protocol (LDAP) systems, potentially affecting over 140,000 tenants globally. The purported breach includes sensitive data such as Java KeyStore files and encrypted passwords. Oracle has officially denied these claims, stating that there has been no breach of Oracle Cloud and that no Oracle Cloud customers experienced a breach or lost any data.

core/paragraph

If you signed the Oracle Cloud Services Agreement with minimal negotiation, then the terms are not favorable to address this potential situation. While Oracle implements standard security measures and complies with applicable data protection regulations, the agreement places significant responsibility on customers for their data's content and compliance. Additionally, Oracle's liability in the event of a data breach is notably limited and the agreement is silent on payment of costs associated with a data breach.

Regardless of the breach's validity, this situation underscores the critical importance of implementing strong contractual protections when engaging with cloud service providers who have access to your data. We recommend the following measures to safeguard your organization's interests:

Data Security Obligations: Ensure contracts explicitly define the provider's responsibilities for data protection, including compliance with relevant regulations and standards.

core/list-item

Incident Notification Requirements: Mandate prompt notification from providers in the event of any security incidents that could impact your data.

Access Controls and Audits: Include clauses that grant your organization the right to audit the provider's security practices and require adherence to stringent access controls.

Liability and Indemnification: Clearly outline the provider's liability in the event of a data breach and include indemnification provisions to protect your organization from potential losses.

Data Ownership and Usage: Specify that your organization retains ownership of all data and delineates permissible uses by the provider to prevent unauthorized exploitation.

core/list

By proactively establishing these contractual safeguards, you can significantly mitigate risks associated with third-party data handling and reinforce your organization's security posture. If you have any questions or require assistance in reviewing your current agreements with cloud service providers, please do not hesitate to contact Kelly Hollingsworth, Nate Steed or your Warner attorney.

Partner

Kelly R. Hollingsworth

Nathan W. “Nate” Steed

Cybersecurity and Privacy

Data and Information Governance

Emphasizing Robust Contracts with Cloud Providers Amid Recent Alleged Breach at Oracle

Warner Norcross + Judd LLP is responsible for the contents of our advertising and this website. Please read our full <a href="/privacy-policy/" aria-label="see privacy policy">privacy policy</a> available on our website. If you have any questions or comments about our website or our Privacy Policy please contact us at <a href="mailto:info@wnj.com">info@wnj.com</a> or 616.752.2000.

Emphasizing Robust Contracts with Cloud Providers Amid Recent Alleged Breach at Oracle

professionals