CISA is aware of potential unauthorized access to a legacy Oracle cloud environment, which may have exposed credential material, posing a risk to organizations and individuals. The reported activity could enable long-term unauthorized access if exposed, especially if credentials are embedded in scripts, applications, or infrastructure templates. Compromised credentials can be used by threat actors to escalate privileges, access cloud and identity management systems, conduct phishing campaigns, and resell or exchange access to stolen credentials. CISA recommends that organizations reset passwords, review source code for hardcoded credentials, monitor authentication logs, and enforce phishing-resistant multi-factor authentication. Users should update potentially affected passwords, use strong and unique passwords, and enable phishing-resistant multifactor authentication. Organizations should report incidents and anomalous activity to CISA's 24/7 Operations Center. The compromise of credential material can pose significant risk to enterprise environments, and CISA provides guidance on reducing these risks. The information provided is for informational purposes only and does not constitute an endorsement of any commercial entity, product, or service. CISA provides additional resources on cloud security best practices, strong passwords, and phishing-resistant multifactor authentication.