Specialist class action lawyers have launched proceedings against Oracle in Texas over two alleged data breaches.

Floridian Michael Toikach is the named plaintiff in law firm Shamis & Gentile’s class action against the cloud giant, which is seeking to represent others who are similarly affected.

Lawyers demanded a jury trial in the US District Court for the Western District of Texas, where Oracle’s headquarters are located in Austin.

One of the primary claims made by the plaintiffs, among many others, is that Oracle violated Texas state data breach notification laws in not informing the alleged victims of a breach within 60 days of becoming aware of one.

The case specifically refers to an alleged breach of Oracle Cloud, and it also alludes to health information being affected in the alleged Oracle Health breach, although this doesn’t appear to be the main focus of the case.

Oracle’s alleged security failings were blamed for the loss of personally identifiable information (PII) and a “wide variety” of personal health data, and Oracle’s silence on the matter exacerbates these claims, the case argues.

Toikach alleges that Oracle has not yet informed him or other customers of a breach, clarified whether it was able to maintain the security of his data, or explained how the alleged incident occurred.

“All of this information is vital to victims of a data breach, let alone a data breach of this magnitude due to the sensitivity and wide array of information compromised in this specific breach,” the case reads.

The plaintiff additionally made a flurry of claims about Oracle’s security posture, including alleging a failure to design and implement adequate network security, train staff on data security, detect an intrusion within a reasonable time frame, or use security tools capable of preventing this kind of attack.

Lawyers cited various articles highlighting data breach victims’ negative financial experiences, arguing that Toikach anticipates “spending considerable time and money on an ongoing basis to try to mitigate and address harms caused by the data breach.”

“As a result of the data breach, plaintiff is at a present risk and will continue to be at increased risk of identity theft and fraud for years to come.”

Toikach and others who may join the case are seeking financial compensation for out-of-pocket costs and damages, as well as commitments from Oracle to improve its security posture.

The Broward County resident claims to take data protection seriously and is very careful about sharing his private information, which he typically stores in a safe and secure location, according to the complaint.

“Plaintiff greatly values his privacy, and would not have provided his private information, undertaken the services, and paid the amounts that he did if he had known that his private information would be maintained using inadequate data security systems.”

VMware has sued industrial giant AG Siemens’s US operations for alleged use of unlicensed software and accused it of changing its story negotiations.

The case was filed last Friday in the US District Court for the District Delaware. VMware’s complaint alleges that Siemens AG’s US operations used more VMware software that it had licensed.

Siemens’s use of VMware became contentious when it tried to arrange extended support for some products.

On September 9, 2024, Siemens apparently produced a list of the VMware software it used and “demanded that VMware accept a purchase order to provide maintenance and support services for the listed products.”

The complaint states that list mentioned VMware deployments that “far exceeded the number of licenses it [Siemens] had actually purchased.”

VMware points out that Siemens had very good reasons to present an accurate list, because mentioning unlicensed products would expose it to legal peril and overstating the extent of its VMware usage would mean it paid more for licenses and support.

VMware claims it reviewed the list, noticed it included unlicensed software, and informed Siemens of its findings.

Siemens apparently responded by insisting the list was correct, demanded VMware accept it, and even threatened to sue the virtualisation giant if it did not provide support services for the listed products.

Siemens felt it had grounds to sue because it had an option to purchase a one-year renewal of support services, believed it had exercised it, and felt VMware was not delivering.

VMware says it agreed to offer support for 30 days “under protest” and because it didn’t want to disrupt Siemens’s operations.

Siemens, meanwhile, appears to have revisited the list it provided in September.

In October, VMware claims Siemens “attempted to retract the list and to offer instead a new list that was closer in line with VMware’s records of Siemens AG’s licenses.”

The complaint alleges Siemens “never provided a credible explanation of why it would have presented and insisted on the accuracy of the September 9 List, if it did not represent its actual deployment of VMware products.”

VMware is also upset that Siemens would not allow a software audit and alleges “other more cooperative and forthcoming customers do [this] without objection.”

Left unable to learn about the true extent of Siemens’s VMware estate, and fearing use of unlicensed software, Broadcom’s virtualisation business unit felt it had no option but to sue.