Thread

1. htrp · 1790105666 · focus · HN ↗

   TLDR. A Peoplesoft (Oracle HR) instance was compromised which allowed movement into GovCloud (AWS)

   1. jimbob45 · 1790109419 · focus · HN ↗

      I’m skeptical that multiple terabytes of data were exfiltrated quietly. I’m struggling to see this as anything other than a bluff.

      1. chrismarlow9 · 1790112940 · focus · HN ↗

         If it was compressed prior to exfiltration it would be much smaller than the original data. I would expect this is mostly human readable text and a fairly high compression ratio. Agree it would still be large but 2 TB at 7:1 ratio drops to 285 GB. I don't know how much these servers are doing with data but I'd suspect sneaking out 10 GB/day over a month or 20GB/day over 2 weeks isn't going to trip up much. The CPU hog for the original compression might, but if you batch out the process in chunks (like a good data engineer), you probably wont trip many thresholds outside of expected use. Just a theory on how I might sneak that much data out of somewhere that has eyes on it, I don't know many details except what's in the article.

         1. Art9681 · 1790133788 · focus · HN ↗

            Anomaly detection is getting better. A small delta can still trigger it. Wether a human reviewed it is another story. But the post mortem will reveal all the signs in hindsight.

Unofficial Hacker News client; not affiliated with Y Combinator.