<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:dc="http://purl.org/dc/elements/1.1/" >

<channel><title><![CDATA[TACTICAL LAW - Blog]]></title><link><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog]]></link><description><![CDATA[Blog]]></description><pubDate>Mon, 20 Apr 2026 10:41:26 -0700</pubDate><generator>Weebly</generator><item><title><![CDATA[Oracle’s Newest Java Audit Demand: Your VMware Topology — and What California Law Says About It]]></title><link><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/oracles-newest-java-audit-demand-your-vmware-topology-and-what-california-law-says-about-it]]></link><comments><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/oracles-newest-java-audit-demand-your-vmware-topology-and-what-california-law-says-about-it#comments]]></comments><pubDate>Sun, 19 Apr 2026 11:20:07 GMT</pubDate><category><![CDATA[Uncategorized]]></category><guid isPermaLink="false">https://www.tacticallawgroup.com/oracle-software-audit-blog/oracles-newest-java-audit-demand-your-vmware-topology-and-what-california-law-says-about-it</guid><description><![CDATA[By Pam Fulmer&#8203;A pattern is now appearing in Oracle&rsquo;s Java licensing enforcement that every in-house counsel with an Oracle footprint needs to understand. On the sales side, Oracle is offering customers what is, in substance, a two-track choice. Customers willing to subscribe on the new per-employee Java SE Universal Subscription metric can do so without producing information about their virtualization environment. Customers who want to remain on &mdash; or return to &mdash; Oracle&rs [...] ]]></description><content:encoded><![CDATA[<div class="paragraph"><strong><font size="4">By Pam Fulmer</font><br /><br />&#8203;A pattern is now appearing in Oracle&rsquo;s Java licensing enforcement that every in-house counsel with an Oracle footprint needs to understand. On the sales side, Oracle is offering customers what is, in substance, a two-track choice. Customers willing to subscribe on the new per-employee Java SE Universal Subscription metric can do so without producing information about their virtualization environment. Customers who want to remain on &mdash; or return to &mdash; Oracle&rsquo;s legacy Named User Plus or Processor-based Java metrics may be required by Oracle to first disclose extensive data covering the entire VMware farm, not only the servers where Oracle software is installed or actually running. A Java licensing conversation is, in other words, being converted into a VMware full environment disclosure.<br /><br />The scope of that demand is the tell. Even under the legacy Named User Plus and Processor options, Java compliance is verified by reference to the servers where Oracle Java is actually installed and/or running. When Oracle asks for data about the full virtualized environment &mdash; including hosts that do not run Oracle software at all &mdash; the data is being collected for a different purpose. This post explains that purpose, why it is dangerous, and the California legal arguments customers can use to push back.</strong><br /><br /><strong>What Oracle Is Asking For</strong><strong>The audit-side of this pattern is now documented in the trade press. Redress Compliance has reported that Java audit letters ask for&nbsp;<a href="https://redresscompliance.com/oracle-is-terrorizing-organizations-with-java-audits/">&ldquo;a full list of all VMware or other virtualized platform hosts, whether they have Java installed or not&rdquo;</a>. House of Brick has documented Oracle asking for vCenter exports and cluster configuration data during Java audits and tying those requests back to Oracle&rsquo;s&nbsp;<a href="https://houseofbrick.com/solutions/licensing-oracle-on-vmware-everything-you-should-know-2/">aggressive position on VMware licensing</a>. And The Register&rsquo;s 2024 coverage of&nbsp;<a href="https://www.theregister.com/2024/06/10/fortune_200_oracle_java_audit/">Java audit letters to Fortune 100 companies</a>&nbsp;signaled the scale of the escalation.<br /><br />The structure of the choice Oracle is offering customers with meaningful Java dependencies deserves a closer look, because it functions as a Hobson&rsquo;s choice. Accepting the per-employee metric avoids any VMware inquiry, but it has made Oracle Java dramatically more expensive for most enterprises than the legacy arrangements. Declining that metric in favor of Named User Plus or Processor-based licensing may require the customer to hand over data on the full VMware environment &mdash; including hosts that have nothing to do with Oracle software. And walking away from Oracle Java altogether is, for many customers, not a short-term option: a disciplined migration to OpenJDK or another supported distribution takes time, requires engineering and testing work, and introduces business risk that cannot be absorbed on Oracle&rsquo;s negotiation timeline.<br /><br />Customers have understandably balked at the VMware-disclosure path. Producing whole-farm topology to Oracle at any stage of a Java engagement raises the risk that the inquiry will expand beyond Java, or that Oracle will use the data to assert compliance claims about other Oracle products running in the same environment &mdash; most obviously Oracle Database. That is the subscription-side extension of the pattern we described in&nbsp;<a href="https://www.tacticallawgroup.com/oracle-software-audit-blog/oracle-java-licensing-enforcement-how-friendly-outreach-is-driving-significant-compliance-risk">&ldquo;Oracle Java Licensing Enforcement: How &lsquo;Friendly Outreach&rsquo; Is Driving Significant Compliance Risk&rdquo;</a>&nbsp;and in&nbsp;<a href="https://www.tacticallawgroup.com/oracle-software-audit-blog/how-oracle-uses-online-agreements-for-free-software-to-trap-companies-into-paying-large-licensing-penalties-the-hidden-costs-of-oracle-java-se-and-virtualbox-software">&ldquo;How Oracle Uses Online Agreements for &lsquo;Free Software&rsquo; to Trap Companies&rdquo;</a>: Oracle&rsquo;s outreach is not just pre-litigation intake &mdash; in some instances it has become pre-audit intake, with the subscription transaction itself used as the lever.</strong><br /><br /><strong>Why It Is Dangerous</strong><strong>The purpose of the VMware request is Oracle&rsquo;s long-running &ldquo;soft partitioning&rdquo; position on database licensing &mdash; the whitepaper theory, never codified in customer agreements, that any physical core in a VMware cluster where Oracle software could theoretically run must be fully licensed. Under its more aggressive expressions, according to Oracle, every host connected to the same vCenter, or reachable by vMotion, must be licensed for any Oracle software running anywhere in the environment. For a customer running a modest Oracle Database footprint on a large VMware estate, the resulting compliance gap is often very large.<br /><br />That position has never been tested in court with a court ruling, and independent specialists &mdash; House of Brick prominent among them &mdash; have argued forcefully that Oracle&rsquo;s soft-partitioning theory is inconsistent with how VMware actually works. But the economic pressure to settle rather than litigate is enormous, and Oracle knows it. A customer who hands over complete vCenter topology during a Java audit has, in practical terms, already pre-calculated the database compliance claim Oracle will assert three months later. The Java audit is the delivery vehicle. The database claim is the payload.</strong><br /><br /><strong>California Legal Arguments That Matter</strong><strong>For Oracle customers &mdash; many of whom operate under Oracle agreements that select California law by an express choice-of-law provision &mdash; California provides a particularly strong toolkit for pushing back on this conduct. As California lawyers, we are intimately familiar with this toolkit.<br />&#8203;<br />The Unfair Competition Law, Business &amp; Professions Code &sect; 17200, is the most flexible and most important of those tools. Section 17200 prohibits any &ldquo;unlawful, unfair, or fraudulent business act or practice.&rdquo; The &ldquo;unfair&rdquo; prong reaches conduct that violates public policy or causes substantial injury, even where no specific statute has been violated. Conditioning the sale of a Java subscription &mdash; priced on a metric entirely unrelated to virtualization &mdash; on the customer&rsquo;s disclosure of VMware topology that will predictably be used to construct a separate, much larger claim appears to fit the &ldquo;unfair&rdquo; framework cleanly. Post-Proposition 64, a UCL plaintiff must show actual injury; a customer who paid an inflated subscription price, or who was forced into a database compliance settlement the disclosure made possible, can satisfy that requirement.<br /><br />The implied covenant of good faith and fair dealing is a second, and often underused, angle. Every California contract includes an implied covenant prohibiting either party from acting to deprive the other of the benefits of the bargain. When Oracle invokes the audit clause from one agreement &mdash; an Oracle Master Agreement, a database OLSA, or an OTN license &mdash; to extract information whose only function is to build claims under a separate product line, the implied covenant may be available as a basis for a claim. Audit rights exist to verify compliance with the agreement that granted them. Using them as reconnaissance for a different product&rsquo;s claims is not what the parties agreed to, and California courts take that distinction seriously.<br /><br />Finally, economic duress. California recognizes the doctrine where one party uses a wrongful act or threat to force another into a transaction it would otherwise refuse, and where the coerced party has no reasonable alternative.&nbsp;<em>Rich &amp; Whillock, Inc. v. Ashton Development, Inc</em>. (1984) 157 Cal.App.3d 1154 remains the foundational authority. The choice Oracle is presenting &mdash; an expensive new metric, or a whole-VMware farm disclosure that will foreseeably build claims elsewhere, or abandoning a business-critical platform on an infeasible timeline &mdash; fits that framework. Most often the scope of Oracle&rsquo;s demanded disclosure has no legitimate relationship to the Java transaction, and a customer whose Java dependencies cannot be unwound on Oracle&rsquo;s timeline has no reasonable alternative. Duress is a particularly valuable defense because it attacks the enforceability of any settlement Oracle later extracts from data produced under coercion.</strong><br /><br /><strong>What To Do When the Pattern Appears</strong><strong>A few practical steps apply whether the demand arrives in a formal audit letter, a GLAS follow-up, or a sales-team email holding up a subscription quote. Stop providing VMware information in any Java communication. Demand in writing that Oracle identify the specific contract clause authorizing the request and the specific Oracle product whose compliance is being verified; if Oracle cannot answer, the request is a fishing expedition. Document any conditioning of a subscription sale on disclosure &mdash; that documentation is the foundation of any UCL, implied-covenant, or duress argument later. And involve counsel before information leaves the company. Early, counsel-led responses are the single strongest predictor of a favorable outcome in this pattern.</strong><br /><br /><br /><strong>Closing Thought</strong><strong>The Java audit is increasingly not about Java. Oracle&rsquo;s enforcement program is a data-gathering operation with a sales objective attached, and the whole-farm VMware demand is the most aggressive expression of that strategy we have yet seen. California law gives customers real tools to resist it &mdash; but those tools only work if the customer reaches for them before the data has been delivered.<br />&nbsp;<br /><br /><em>Tactical Law Group LLP represents enterprise software licensees in Oracle and other software publisher licensing matters, audit defense, and commercial negotiations. Nothing in this post is legal advice or a comment on the specific circumstances of any customer or transaction. If your organization is facing an Oracle Java audit &mdash; or is being told a Java subscription is conditioned on VMware or other environmental disclosure &mdash; please contact us directly.</em></strong></div>]]></content:encoded></item><item><title><![CDATA[2026--The Year Oracle's Java Audits Get Real]]></title><link><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/2026-the-year-oracles-java-audits-get-real]]></link><comments><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/2026-the-year-oracles-java-audits-get-real#comments]]></comments><pubDate>Sun, 19 Apr 2026 09:36:54 GMT</pubDate><category><![CDATA[Uncategorized]]></category><guid isPermaLink="false">https://www.tacticallawgroup.com/oracle-software-audit-blog/2026-the-year-oracles-java-audits-get-real</guid><description><![CDATA[By Pam FulmerFor three years, we have been writing about Oracle&rsquo;s Java licensing enforcement as a slow-motion campaign &mdash; one that began with &ldquo;friendly&rdquo; compliance emails, continued through a series of escalating sales-team overtures, and rarely produced a formal audit letter. That campaign is now changing character. In 2026, the soft outreach is giving way to formal audit notices issued under Oracle&rsquo;s license management function &mdash; what used to be called LMS, a [...] ]]></description><content:encoded><![CDATA[<div class="paragraph"><strong><font size="4">By Pam Fulmer</font><br /><br />For three years, we have been writing about Oracle&rsquo;s Java licensing enforcement as a slow-motion campaign &mdash; one that began with &ldquo;friendly&rdquo; compliance emails, continued through a series of escalating sales-team overtures, and rarely produced a formal audit letter. That campaign is now changing character. In 2026, the soft outreach is giving way to formal audit notices issued under Oracle&rsquo;s license management function &mdash; what used to be called LMS, and is now branded Global Licensing and Advisory Services, or GLAS. The letters are arriving. They look and feel different from what Oracle Java customers have seen for the last several years. And the pattern of who is getting them is not random.<br /><br />Our view, which we have previewed in earlier posts, is that this moment has been structurally inevitable since early 2023 &mdash; the year Oracle replaced its prior Java SE subscription with the Java SE Universal Subscription, a per-employee model that made Java dramatically more expensive for most enterprises and fundamentally changed Oracle&rsquo;s enforcement economics. This post explains why the formal audits are finally here, what they actually look like, and what Oracle Java customers should be doing before &mdash; or, if the letter has already arrived, during &mdash; the audit.<br /><br /><font size="4">How We Got Here</font><br />The current story starts with Oracle&rsquo;s decision, announced in January 2023, to move Java SE off a per-user and per-processor model and onto a per-employee model covering every employee, contractor, and agent of a subscribing entity &mdash; whether or not they actually use Java. We wrote about the immediate commercial effect in <a href="https://www.tacticallawgroup.com/oracle-software-audit-blog/oracle-changes-java-se-licensing-rules-and-prices-explode" target="_blank">Oracle Changes Java SE Licensing Rules and Prices Explode</a>, and the practical upshot has not changed: for most enterprises the cost of Oracle Java increased dramatically, in many cases by a multiple of what the prior subscription had charged. Many companies concluded, reasonably, that the new model was not for them. They began evaluating OpenJDK, Amazon Corretto, Azul Zulu, and other supported alternatives. Some migrated. Some did not.<br /><br />What happened next was not a quiet period. It was a campaign. As we described in <a href="https://www.tacticallawgroup.com/oracle-software-audit-blog/oracle-java-licensing-enforcement-how-friendly-outreach-is-driving-significant-compliance-risk?utm_source=mondaq&amp;utm_medium=syndication&amp;utm_content=sourceoriginal&amp;utm_campaign=" target="_blank">Oracle Java Licensing Enforcement: How &ldquo;Friendly Outreach&rdquo; Is Driving Significant Compliance Risk</a>, Oracle&rsquo;s sales and compliance teams began contacting organizations with pointed but informal questions about their Java deployments. Those inquiries were frequently positioned as helpful &mdash; an offer to &ldquo;clarify&rdquo; licensing status, or a suggestion that the company might qualify for a &ldquo;special transition&rdquo; subscription. In Warning to Oracle Customers: Don&rsquo;t Be Fooled By Oracle&rsquo;s Java Playbook, we explained why that framing was &mdash; and is &mdash; dangerous. The calls and emails were not customer service. They were pre-litigation intake.<br /><br /><font size="4">Why the Formal Audits Are Finally Coming</font><br />Three things have changed in 2025 and 2026 that are now driving formal audit letters in volume.<br />&#8203;<br />First, Oracle has had three years to gather data. As we discussed in <a href="https://www.tacticallawgroup.com/oracle-software-audit-blog/how-oracle-uses-online-agreements-for-free-software-to-trap-companies-into-paying-large-licensing-penalties-the-hidden-costs-of-oracle-java-se-and-virtualbox-software" target="_blank">How Oracle Uses Online Agreements for &ldquo;Free Software&rdquo; to Trap Companies</a>, Oracle tracks downloads of Java binaries in detail &mdash; IP addresses, corporate domain associations, download timestamps, and whatever account information was used at download. It also logs the automatic update check-ins made by every installed copy of Oracle Java that has not been affirmatively disconnected from Oracle&rsquo;s servers. Three years of that telemetry, cross-referenced against whatever the friendly outreach emails extracted from the company directly, is now a usable audit foundation. The companies Oracle is sending formal letters to in 2026 are not being chosen at random.<br /><br />Second, the soft-outreach stonewall has produced a target list. Companies that responded to the friendly outreach by buying the subscription on Oracle&rsquo;s terms were never going to receive a formal audit letter &mdash; they were already paying. Companies that simply did not respond, or that responded with a polite &ldquo;we use non-Oracle Java,&rdquo; were implicitly telling Oracle that the only way to convert them was through the audit clause in their existing Oracle agreements or through the click-wrap terms they accepted when they downloaded Oracle Java. Three years later, that target list is mature.<br /><br />Third, Oracle has business reasons to push harder now. As we wrote in our recent coverage of the Rimini Street settlement, Oracle&rsquo;s financial story has pivoted to a cloud and AI infrastructure business whose margins are widely understood to be thinner than its legacy support business. The support and subscription revenue line &mdash; the line that includes the Java SE Universal Subscription &mdash; has become more, not less, critical to Oracle&rsquo;s investor narrative. Converting long-resistant Java customers into subscription customers, via audit, is directly aligned with that strategy.<br /><br />There is a fourth factor worth naming separately. We have seen an emerging pattern &mdash; which we flagged earlier and which the trade press has since confirmed &mdash; of Oracle declining to sell Java subscriptions to certain customers unless those customers first disclose detailed usage and employee-count information. In some instances, companies that tried to buy their way into compliance have been told, in effect, that compliance is not available to them without first producing the data that typically comes out of an audit. That is not a sales process. It is a structure for manufacturing non-compliance, and in-house counsel should treat it as such.<br /><br /><font size="4">What a Formal Java Audit Letter Looks Like</font><br />The formal audit letters arriving in 2026 look meaningfully different from the outreach emails that preceded them. They are typically addressed to a named C-suite executive &mdash; CIO, CFO, or General Counsel &mdash; and signed by an Oracle GLAS representative rather than a salesperson. They cite an audit clause either in the company&rsquo;s existing Oracle Master Agreement (if the company holds other Oracle products) or in the Oracle Technology Network License Agreement that governed the original Java download. They name an audit window &mdash; commonly forty-five days &mdash; and specify whether the review will be conducted directly by GLAS or through a designated third-party auditor. And they set an expansive scope: global employee counts, deployments by version, installation inventories, virtualization and cloud environments, and anything Oracle believes relates to its employee-metric calculation. For readers who want a deeper walk through how Oracle conducts these engagements generally, our earlier post Oracle Knows More About You Than You Think: Lessons from Oracle v. Kelkar remains directly on point.<br /><br /><font size="4">What Oracle Java Customers Should Be Doing Now</font><br />Whether or not a formal letter has already arrived, a few things are worth doing now.<br />Inventory your own Java deployments before Oracle tells you what they are. The most damaging audit outcomes we see are the ones where the company learns the size of its Java footprint from Oracle &mdash; usually at a moment when the company has lost most of its negotiating leverage. Counsel-led internal discovery, done under privilege, almost always produces a more favorable result.<br /><br />Understand which license terms actually govern your Java usage. Not every Java installation is governed by the same agreement. Versions and licenses have changed several times since 2019, and what you downloaded in 2018 is almost certainly not what you downloaded in 2024. Older, more permissive license grants still exist in many environments. Identifying them is often the single most important step in a Java audit defense.<br /><br />Do not respond to &ldquo;friendly outreach&rdquo; without counsel. The consistent pattern we see is that informal responses to Oracle&rsquo;s pre-audit inquiries become the foundation of the formal audit that follows. If an email from an Oracle Java team member has landed in your inbox and you have not yet responded, treat it the way you would treat a preservation letter.<br /><br />If the formal audit letter has arrived, assert the procedural protections you are entitled to. Oracle audit clauses are negotiable in practice, even if they look one-sided on the page. Scope, timeline, choice of auditor, and handling of proprietary data are all areas where experienced counsel can substantially change the trajectory of an audit.<br />&#8203;<br /><font size="4">Closing Thought</font><br />None of this was unpredictable. We wrote, in Java Audits Likely Will Increase as Oracle Seeks to Move Java Users onto its Total Employee Metric, that the shift to the employee metric would eventually produce a wave of formal audits, and that the quiet soft-outreach period was not a feature of Oracle&rsquo;s enforcement posture but a phase of it. That phase is now closing. The companies that treated the last three years as a chance to prepare &mdash; to inventory, to analyze their contracts, and to reduce their dependence on Oracle Java where alternatives exist &mdash; are in a materially stronger position than those that assumed the outreach would simply go away. It did not. It never does.<br /><br /><em>Tactical Law Group LLP represents enterprise software licensees in Oracle and SAP licensing matters, audit defense, and commercial negotiations. Nothing in this post is legal advice. If an Oracle audit letter has arrived at your organization &mdash; or if you are receiving the &ldquo;friendly&rdquo; pre-audit emails that tend to precede one &mdash; please contact us directly.</em></strong></div>]]></content:encoded></item><item><title><![CDATA[The Oracle-Rimini Settlement and What it Means for Oracle Customers]]></title><link><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/the-oracle-rimini-settlement-and-what-it-means-for-oracle-customers]]></link><comments><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/the-oracle-rimini-settlement-and-what-it-means-for-oracle-customers#comments]]></comments><pubDate>Fri, 17 Apr 2026 14:17:20 GMT</pubDate><category><![CDATA[Uncategorized]]></category><guid isPermaLink="false">https://www.tacticallawgroup.com/oracle-software-audit-blog/the-oracle-rimini-settlement-and-what-it-means-for-oracle-customers</guid><description><![CDATA[By Pam FulmerWhen Oracle and Rimini Street announced their confidential settlement in July 2025, the headlines framed the moment as the quiet close of a decade-plus copyright saga. For the lawyers who lived through the case, that was certainly true. But for the Oracle customers who have watched this litigation from the sidelines &mdash; often while writing twenty-two-percent-of-license-cost checks to Oracle each year &mdash; the settlement is not the end of anything. It is the beginning of a new [...] ]]></description><content:encoded><![CDATA[<div class="paragraph"><strong><font size="4">By Pam Fulmer</font><br /><br />When Oracle and Rimini Street announced their confidential settlement in July 2025, the headlines framed the moment as the quiet close of a decade-plus copyright saga. For the lawyers who lived through the case, that was certainly true. But for the Oracle customers who have watched this litigation from the sidelines &mdash; often while writing twenty-two-percent-of-license-cost checks to Oracle each year &mdash; the settlement is not the end of anything. It is the beginning of a new round of questions about who controls the cost of enterprise software support, and who is going to pay for it.<br /><br />We have written before about the litigation and the Ninth Circuit&rsquo;s December 2024 opinion that forced the parties to the table. This post is about what comes next. The short version: the Ninth Circuit handed Oracle a loss on the law. The settlement handed Oracle something it arguably wanted more &mdash; a clear off-ramp for one of the largest pools of customers who had found a cheaper alternative to Oracle&rsquo;s support machine. The question Oracle customers should be asking is whether that trade will show up in their renewal invoices.</strong><br /><br /><strong><font size="4">A Quick Refresher</font></strong><br /><strong>The settlement has three load-bearing pieces: Oracle returned approximately $37.8 million of the attorneys' fees the lower court awarded to Rimini Street; Rimini agreed to wind down its third-party support for Oracle PeopleSoft by July 31, 2028; and both sides dropped their remaining claims with neither admitting wrongdoing. The parties reached this deal after the Ninth Circuit vacated nearly every material copyright ruling against Rimini, reversed the Lanham Act judgment, and set aside the injunction. The court called the district court&rsquo;s reading of &ldquo;derivative work&rdquo; &ldquo;hopelessly overbroad,&rdquo; and held that &ldquo;mere interoperability isn&rsquo;t enough&rdquo; &mdash; a party must actually, substantially incorporate copyrighted material to infringe the right to prepare a derivative work. On the law, the third-party support industry walked out of the Ninth Circuit in a stronger position than it walked in. Which is precisely why the settlement terms &mdash; and the PeopleSoft wind-down specifically &mdash; are interesting.</strong><br /><br /><strong><font size="4">Oracle&rsquo;s Support Business, and Why It Matters Here</font></strong><br /><br /><strong>Anyone who has read Oracle&rsquo;s recent annual reports understands a simple fact: the company&rsquo;s revenue is no longer dominated by new software license sales. The overwhelming majority of what Oracle takes in every year comes from cloud services, subscriptions, and &mdash; critically for this discussion &mdash; license support. Support and subscription revenue is not a sideline for Oracle. It is the business. And it is a remarkably profitable one. Software support &mdash; the recurring fee Oracle collects in exchange for patches, bug fixes, and portal access &mdash; carries famously high margins by enterprise software standards, meaningfully above Oracle&rsquo;s already-robust overall margin. When you compound those margins over decades of paid-up license bases, you see why Oracle&rsquo;s investor story has for years been less about selling new software and more about keeping the existing customer base inside the paying support tent.<br /><br />The mechanics are worth spelling out. Oracle&rsquo;s standard Premier Support fee is twenty-two percent of the net license fee, charged annually &mdash; a figure codified in Oracle&rsquo;s own published support policies, which also reserve Oracle&rsquo;s right to raise that fee annually based on &ldquo;inflationary&rdquo; adjustments Oracle itself sets. Historically modest, those annual uplifts have in recent years trended meaningfully higher than conventional inflation. Over a ten-year horizon on a large license base, the compounding effect is substantial &mdash; the difference between a support budget that stays roughly flat in real terms and one that quietly doubles.</strong><br /><br /><strong><font size="4">Why the Settlement Terms Favor Oracle, Even If the Law Did Not</font></strong><br /><strong>Read against that financial backdrop, the 2028 PeopleSoft sunset is not a footnote. It is the point. PeopleSoft is a mature product set Oracle acquired in 2005. Many PeopleSoft customers have paid-up perpetual licenses, no interest in migrating to an Oracle cloud suite on Oracle&rsquo;s timeline, and every reason to keep their existing systems running on a leaner support contract. That profile &mdash; stable, installed, resistant to re-platforming &mdash; is exactly what third-party support is built for, and exactly what is most valuable to Oracle if it can be kept on Oracle Premier Support for as long as possible. By securing a firm date by which one of the largest third-party support providers will stop supporting PeopleSoft, Oracle has effectively put a clock on a slice of the third-party support market it cares about most. Those customers will be deciding between 2026 and 2028 whether to return to Oracle support, move to another third-party provider, accelerate a replatforming project, or run unsupported.<br /><br />Nothing in the Ninth Circuit opinion compelled that outcome. The court&rsquo;s holding cuts the other way &mdash; it makes copyright doctrine a harder tool for Oracle to use against third-party support providers. What the settlement did is trade a legal theory that was failing in court for a commercial concession extracted at the bargaining table. A rational outcome for a sophisticated plaintiff. But worth looking at clearly from the customer&rsquo;s side.<br /><br />A note on Rimini: we have enormous respect for the role the company has played &mdash; and continues to play &mdash; in giving Oracle and SAP customers a meaningful alternative to vendor support. Rimini did not lose this litigation in any conventional sense. The company vindicated the legality of independent third-party support at the Ninth Circuit, survived a fifteen-year campaign from one of the best-resourced plaintiffs in technology, and continues to serve thousands of customers across Oracle, SAP, and other enterprise software product families. The PeopleSoft wind-down is a defined, manageable transition. The narrower question for Oracle customers is not whether Rimini survived &mdash; it is whether Oracle&rsquo;s pricing leverage on its most captive installed base just got stronger.</strong><br /><br /><strong><font size="4">The Pricing Question</font><br />&#8203;</strong><strong>There are two plausible reads on what happens to Oracle support pricing over the next three to five years.<br /><br />The optimistic read: the third-party support market is bigger and more robust than ever, with more credible providers serving more customers across more product lines than when the Rimini litigation began. Competitive pressure &mdash; from Spinnaker Support, Support Revolution, Rimini itself, and others &mdash; keeps Oracle from pushing support fees arbitrarily without accelerating customer defections. The twenty-two-percent fee plus modest annual uplifts stays roughly where it is.<br /><br />The cautious read: the PeopleSoft sunset is a signal. For those customers specifically, Oracle now has a defined window in which a meaningful share will be forced to make a decision, with every incentive to make the return-to-Oracle option attractive up front while positioning for price increases once those customers are back inside the tent. More broadly, if Oracle concludes that commercial-term negotiations with third-party providers can substitute for a failing copyright strategy, similar dynamics may play out in other product lines. And Oracle&rsquo;s public posture is not subtle: its reliance on support and subscription revenue is increasing as its growth narrative pivots to cloud and AI infrastructure whose margins are widely understood to be thinner. When margins compress in one place, there is a natural pull on management to protect margins elsewhere.<br /><br />We do not yet know which read is closer to right. But customers who assume the settlement is simply &ldquo;news&rdquo; &mdash; a 2025 storyline requiring no action &mdash; are taking a position that the next three years of renewal cycles may test.</strong><br /><br /><strong><font size="4">What This Means for Oracle Customers</font><br />&#8203;</strong><strong>A few things flow from all of this. First, the legal ground under third-party support is firmer, not softer, after the Ninth Circuit opinion &mdash; customers still hesitant about the legal risk should understand the highest recent appellate statement runs the other way. Second, PeopleSoft customers on Rimini support should be planning now, not in 2027; a thoughtful transition takes longer than most organizations expect and benefits from being planned before leverage shifts toward the deadline. Third, every Oracle renewal conversation from here forward is a pricing conversation, and customers who want to hold the line need to build leverage well before the renewal window. Finally &mdash; and this is the piece our firm spends the most time on &mdash; the support-cost question is inseparable from the audit-risk question. Oracle&rsquo;s audit practice and its support renewal practice are two sides of the same revenue engine, and serious customers have to manage both together.<br /><br />The Rimini Street settlement is, narrowly, a story about one provider and one product line. Broadly, it is a story about who bears the cost of Oracle&rsquo;s transition to being an AI-and-cloud company financed by a support annuity business. The Ninth Circuit made clear that copyright law is not going to do that work for Oracle. The settlement shows that commercial leverage might. None of this is reason to panic. It is reason to stop treating enterprise software support as a fixed cost line that simply renews itself each year &mdash; and to start treating it as a contract that is actively managed, aggressively negotiated, and regularly benchmarked against a growing and legally-vindicated ecosystem of alternatives. The customers who engage early keep control of their own budgets.<br />&nbsp;<br /><br /><em>Tactical Law Group LLP advises enterprise software licensees on Oracle and SAP licensing, audit defense, and commercial negotiations. Nothing in this post is legal advice. If you have questions about your organization&rsquo;s Oracle support or audit posture, please contact us directly.</em></strong></div>]]></content:encoded></item><item><title><![CDATA[Oracle Knows More About You Than You Think: Lessons from Oracle v. Kelkar]]></title><link><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/oracle-knows-more-about-you-than-you-think-lessons-from-oracle-v-kelkar]]></link><comments><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/oracle-knows-more-about-you-than-you-think-lessons-from-oracle-v-kelkar#comments]]></comments><pubDate>Tue, 14 Apr 2026 10:12:35 GMT</pubDate><category><![CDATA[Uncategorized]]></category><guid isPermaLink="false">https://www.tacticallawgroup.com/oracle-software-audit-blog/oracle-knows-more-about-you-than-you-think-lessons-from-oracle-v-kelkar</guid><description><![CDATA[By Pam FulmerOn April 9, 2026, Oracle filed a federal lawsuit in the Eastern District of North Carolina against its former employee, Pravin Kelkar, alleging trade secret misappropriation and breach of contract. The case,&nbsp;Oracle America, Inc. v. Kelkar(Case No. 5:26cv236), reads like a corporate thriller: a terminated employee threatening to sell Oracle's proprietary databases to the highest bidder. But buried inside the drama is a revelation that should concern every Oracle customer. Oracle [...] ]]></description><content:encoded><![CDATA[<div class="paragraph"><strong><font size="4">By Pam Fulmer</font><br /><br />On April 9, 2026, Oracle filed a federal lawsuit in the Eastern District of North Carolina against its former employee, Pravin Kelkar, alleging trade secret misappropriation and breach of contract. The case,&nbsp;<em>Oracle America, Inc. v. Kelkar</em>(Case No. 5:26cv236), reads like a corporate thriller: a terminated employee threatening to sell Oracle's proprietary databases to the highest bidder. But buried inside the drama is a revelation that should concern every Oracle customer. Oracle's own Complaint lays out, in remarkable detail, just how much information Oracle collects about its customers and how central that data is to Oracle's sales machine.<br /><br /><font color="#24678d" size="4">What the Complaint Alleges</font><br />Pravin Kelkar worked at Oracle for over five years, most recently in a sales operation&rsquo;s role supporting Oracle's Life Sciences businesses. When Mr. Kelkar got caught up in Oracle&rsquo;s recent massive layoff (Oracle eliminated his position on March 31, 2026), the Complaint alleges that Kelkar responded by sending threatening messages to Oracle's HR team and senior executives. He claimed to have transferred Oracle's entire "install base" database to a personal device and threatened to sell it to Oracle's competitors unless Oracle met his demands for two years of full salary, benefits, and immediate vesting of his restricted stock units.<br /><br />Oracle attempted to resolve the matter without litigation, contacting Kelkar by letter and phone, requesting that he return the data and submit his personal devices for forensic inspection. Kelkar refused to fully cooperate, at one point claiming his threats were made "in jest," while simultaneously declining to return the materials or allow an inspection. Oracle filed suit nine days later, seeking emergency injunctive relief under the Defend Trade Secrets Act.<br /><br /><font color="#24678d" size="4">The Real Story: What Oracle Considers Its "Install Base"</font><br />The most revealing aspect of this Complaint is not Kelkar's conduct. It is Oracle's own detailed description of what its "install base" databases contain and why Oracle considers them to be among its most valuable trade secrets.<br /><br />According to Oracle's Complaint, the install base databases include granular, confidential details about Oracle's customer relationships, covering information such as which products and services each customer uses, where those products are deployed, confidential pricing and contract terms, support identifier numbers for each customer, sales history broken down by fiscal quarter and week, product-use information, contract status and renewal timing, forecast and pipeline information, account ownership and sales representative contact information, and facility or site-level deployment details.<br /><br />Oracle maintains separate install base databases for its North America region, its Oracle Health business (formed after Oracle's 2022 acquisition of Cerner Corporation), and its Fusion product lines. The company describes these databases as representing years of ongoing development, built and maintained at substantial time, effort, and expense by its sales and operations teams.<br /><br />Oracle's Complaint explains that these databases exist for a specific purpose: to provide Oracle's sales and operations teams with the information they need to facilitate the maintenance and growth of customer relationships, track sales and renewal schedules, and provide critical data on software revenue and profitability. In other words, Oracle is not simply storing this data for record-keeping. It is actively using it to drive sales strategy, identify upsell and cross-sell opportunities, and time its outreach around contract renewals.<br /><br /><font color="#24678d" size="4">Why This Should Concern Oracle Customers</font><br />Oracle's Complaint makes clear that the company views its customer data as a competitive weapon. Oracle itself alleges that a competitor could use this information to uproot its customers by reviewing what products they use, what their impending needs are, what prices they pay, and when their contracts end.<br /><br />Turn that sentence around: if a competitor could use this data to target Oracle's customers, Oracle itself is certainly using this same data to target its own customers for additional sales. Oracle knows what you have deployed, what you are paying, when your contracts come up for renewal, and what your usage patterns look like. That is an extraordinary informational advantage in any negotiation.<br /><br />For Oracle customers, the implications are significant. Every interaction with an Oracle sales representative, every support ticket, every deployment discussion is potentially feeding a database that Oracle uses to craft its sales approach. When Oracle contacts you about a renewal or a new product offering, it is not making a cold call. It is working from a detailed dossier on your entire Oracle footprint.<br /><br /><font color="#24678d" size="4">What Companies Should Do</font><br />The&nbsp;<em>Oracle v. Kelkar</em>&nbsp;case is a wake-up call for any organization running Oracle software. Oracle is meticulously tracking your data, and it is using that data to maximize its revenue from your account. Companies that want to level the playing field should consider the following steps.<br /><br /><font color="#24678d">Control the flow of information to Oracle.</font>&nbsp;Establish clear internal policies about what employees can and cannot share with Oracle sales representatives. Not every conversation needs to include details about your deployment plans, budget cycles, or technology roadmap. Train your teams to understand that information shared with Oracle does not disappear; it goes into a database.<br /><br /><font color="#24678d">Centralize your Oracle relationship</font>.&nbsp;Designate a small team or a single point of contact responsible for managing Oracle communications. This prevents Oracle from gathering intelligence across multiple departments and assembling a more complete picture of your organization than any one person intended to provide.<br /><br /><font color="#24678d">Understand your contractual position before Oracle does.</font>&nbsp;Oracle knows your renewal dates, your pricing history, and your deployment footprint. You should know these things at least as well as Oracle does. Conduct regular internal audits of your Oracle estate so that you are never negotiating from a position of informational disadvantage.<br /><br /><font color="#24678d">Be strategic about support and deployment conversations</font>.&nbsp;Technical support interactions and implementation discussions can reveal information about how you use Oracle products, where you are experiencing growth, and what your future needs might look like. Be thoughtful about what details are shared and through which channels.<br />&#8203;<br /><font color="#24678d">Engage experienced counsel before Oracle comes knocking.</font>&nbsp;Whether you are facing an audit, negotiating a renewal, planning a migration, or simply trying to understand your rights under your existing agreements, having advisors who understand Oracle's playbook can make an enormous difference in outcomes.<br /><br /><font color="#24678d" size="4">How Tactical Law Can Help</font><br />At Tactical Law, we have deep experience advising companies on their Oracle relationships. We understand how Oracle structures its sales organization, how it uses customer data to drive its licensing and audit strategies, and how companies can protect themselves from being outmaneuvered.<br /><br />Whether you are preparing for an Oracle license audit, negotiating a complex renewal, evaluating a migration to Oracle Cloud or away from Oracle entirely, or simply trying to get a handle on your current Oracle exposure, our team can help you develop a strategy that protects your interests and your budget.<br /><br />Oracle has a database full of information about you. We help you make sure the playing field is level.<br />&#8203;<br /><font color="#24678d">Contact Tactical Law today</font>&nbsp;to learn how we can help your organization take control of its Oracle relationship.<br /><br /><br /><em>Disclaimer: This article is provided for informational purposes only and does not constitute legal advice. The discussion of Oracle v. Kelkar is based on allegations contained in the publicly filed Complaint and does not represent findings of fact by any court.</em></strong><br /><br /></div>]]></content:encoded></item><item><title><![CDATA[Is SAP Using Its Audit Rights to Drive Your Next Purchase?]]></title><link><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/is-sap-using-its-audit-rights-to-drive-your-next-purchase]]></link><comments><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/is-sap-using-its-audit-rights-to-drive-your-next-purchase#comments]]></comments><pubDate>Fri, 10 Apr 2026 11:00:26 GMT</pubDate><category><![CDATA[Uncategorized]]></category><guid isPermaLink="false">https://www.tacticallawgroup.com/oracle-software-audit-blog/is-sap-using-its-audit-rights-to-drive-your-next-purchase</guid><description><![CDATA[By Pam FulmerThis is the first in a series of articles from Tactical Law examining the SAP licensing landscape and what it means for your organization.If your company runs SAP, there's a good chance you'll face a license audit in the next few years &mdash; and the outcome may cost you far more than you expect.SAP's license audit program has become one of the company's most effective tools for generating new revenue. Buried in most SAP contracts is a clause granting SAP the right to review your l [...] ]]></description><content:encoded><![CDATA[<div class="paragraph"><strong><font size="4">By Pam Fulmer</font><br /><br /><em>This is the first in a series of articles from Tactical Law examining the SAP licensing landscape and what it means for your organization.</em><br /><br />If your company runs SAP, there's a good chance you'll face a license audit in the next few years &mdash; and the outcome may cost you far more than you expect.<br /><br />SAP's license audit program has become one of the company's most effective tools for generating new revenue. Buried in most SAP contracts is a clause granting SAP the right to review your license compliance, typically on an annual basis. While not every customer is audited every year, SAP's Global License Audit &amp; Compliance team selects targets strategically &mdash; and when they come knocking, the financial stakes can be significant.<br />&#8203;<br /><font color="#da8044" size="4">How the Audit Becomes a Sales Conversation</font><br />Here's what many SAP customers don't realize until they're in the middle of it: an audit finding isn't a fine. It's the opening move in a negotiation.<br /><br />When SAP identifies a licensing shortfall &mdash; whether that's too many users, the wrong user classifications, or unlicensed system integrations &mdash; the compliance team works in coordination with SAP's sales organization. The shortfall creates urgency. The sales team then presents the remedy: additional licenses, a conversion to RISE with SAP, adoption of a new licensing model, or an expanded cloud subscription. Customers mid-migration to S/4HANA are particularly exposed, because they're already committed to a massive project and have limited leverage to push back.<br /><br /><font color="#da8044" size="4">Where SAP Focuses Its Audits</font><br />SAP's audit teams have become increasingly sophisticated about where they look. Four areas dominate current audit activity:<br /><br />Indirect access&nbsp;is the most consequential. Whenever a third-party system &mdash; your e-commerce platform, CRM, supplier portal, or any external application &mdash; reads from or writes to SAP, SAP takes the position that those interactions require licensing. Under their Digital Access model, this is measured by counting business documents like sales orders and invoices created by outside systems. For companies with heavily integrated environments, the exposure can be substantial.<br /><br />User classification&nbsp;is another frequent finding. SAP licenses are tiered by the transactions a user is permitted to run, and each tier carries a different price. If an employee classified at a lower tier has executed even a single transaction reserved for a higher tier, SAP will argue that person should have been licensed at the more expensive level &mdash; across your entire user base, these reclassifications add up quickly.<br /><br />S/4HANA migration compliance&nbsp;has become a major focus as SAP's 2027 end-of-support deadline for the older ECC system approaches. Companies running both systems in parallel during migration face the risk of double-counting licenses, and SAP's licensing metrics change between ECC and S/4HANA &mdash; meaning what was compliant under the old system may not be under the new one.<br /><br />HANA memory consumption&nbsp;rounds out the list. As data volumes grow, SAP checks whether your actual database memory usage exceeds what you've licensed.<br /><br /><font color="#da8044" size="4">Why This Matters Now</font><br />The 2027 ECC end-of-support deadline is accelerating everything. Every company still running the older SAP system faces a decision &mdash; migrate to S/4HANA, move to SAP's cloud offering, or find an alternative. SAP's audit activity tends to intensify during these transition windows, because customers facing a deadline are far more likely to settle compliance disputes quickly in exchange for favorable migration terms.<br /><br />In short, the audit isn't just about compliance. It's a strategically timed part of SAP's commercial playbook.<br />&#8203;<br /><font color="#da8044" size="4">How Tactical Law Can Help</font><br />Navigating an SAP audit requires a clear understanding of your contractual rights, your actual usage patterns, and SAP's negotiating tactics. Many organizations go into these conversations underinformed and come out having agreed to terms they didn't need to accept.<br /><br />Tactical Law works with companies to evaluate their licensing exposure, prepare for audit engagements, and negotiate from a position of knowledge rather than surprise.<br /><br />Whether you're facing an active audit, planning an S/4HANA migration, or simply want to understand where you stand, we can help you see the full picture before SAP defines it for you.<br /><br /><em>&#8203;Have questions about your SAP licensing situation? Contact us to start a conversation.</em></strong><br /><br /></div>]]></content:encoded></item><item><title><![CDATA["You Have to Keep Paying No Matter What" — Why That Clause in Your Oracle Financing Agreement May Not Be Enforceable in California]]></title><link><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/you-have-to-keep-paying-no-matter-what-why-that-clause-in-your-oracle-financing-agreement-may-not-be-enforceable-in-california]]></link><comments><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/you-have-to-keep-paying-no-matter-what-why-that-clause-in-your-oracle-financing-agreement-may-not-be-enforceable-in-california#comments]]></comments><pubDate>Thu, 26 Mar 2026 11:51:21 GMT</pubDate><category><![CDATA[Uncategorized]]></category><guid isPermaLink="false">https://www.tacticallawgroup.com/oracle-software-audit-blog/you-have-to-keep-paying-no-matter-what-why-that-clause-in-your-oracle-financing-agreement-may-not-be-enforceable-in-california</guid><description><![CDATA[ By Pam FulmerIf your business financed an Oracle NetSuite ERP implementation through Oracle Credit Corporation or Oracle America, Inc. and received a collection demand from Banc of America Leasing &amp; Capital, LLC or Bank of America N.A., or another bank, you may have been told that you must keep making payments even if the software was never delivered, never worked, or was sold to you through misrepresentation. There are ways to attack the clause under California law, but Oracle and its assi [...] ]]></description><content:encoded><![CDATA[<span class='imgPusher' style='float:right;height:1116px'></span><span style='display: table;width:729px;position:relative;float:right;max-width:100%;;clear:right;margin-top:20px;*margin-top:40px'><a><img src="https://www.tacticallawgroup.com/uploads/5/2/9/1/52915149/published/screenshot-2026-03-26-at-5-33-05-am.png?1774526882" style="margin-top: 5px; margin-bottom: 10px; margin-left: 0px; margin-right: 10px; border-width:1px;padding:3px; max-width:100%" alt="Picture" class="galleryImageBorder wsite-image" /></a><span style="display: table-caption; caption-side: bottom; font-size: 90%; margin-top: -10px; margin-bottom: 10px; text-align: center;" class="wsite-caption"></span></span> <div class="paragraph" style="display:block;"><strong><font size="4">By Pam Fulmer</font><br /><br /><em>If your business financed an Oracle NetSuite ERP implementation through Oracle Credit Corporation or Oracle America, Inc. and received a collection demand from Banc of America Leasing &amp; Capital, LLC or Bank of America N.A., or another bank, you may have been told that you must keep making payments even if the software was never delivered, never worked, or was sold to you through misrepresentation. There are ways to attack the clause under California law, but Oracle and its assignees have developed a clever scheme that shifts risk to the Oracle customer and gives Oracle leverage in settlement discussions.</em><br /><br />&#8203;When a NetSuite implementation fails &mdash; and industry litigation makes clear that this seems to happen with some frequency &mdash; Oracle customers quickly discover an uncomfortable reality. The company that sold them the software and promised a successful implementation has already sold off the right to collect their payments. Oracle Credit Corporation (OCC), Oracle's captive financing subsidiary or Oracle America, Inc. itself (collectively &ldquo;Oracle&rdquo;), assigned the payment stream to a third-party bank almost immediately after the contract was signed. That bank, often Banc of America Leasing &amp; Capital, LLC (&ldquo;BALC&rdquo;) or Bank of America N.A. (&ldquo;BANA&rdquo;) or a Wells Fargo entity, now shows up demanding full payment and citing a clause in the financing agreement that says, in effect, you agreed to pay the Assignee no matter what. At last count since 2020, BALC had filed over 70 collections lawsuits in San Mateo Superior Court in California alone seeking to enforce these assignments against Oracle customers.<br /><br />This clause &mdash; sometimes called a "hell or high water" provision or a "waiver of defenses" clause &mdash; is a deliberate piece of transaction engineering. Although we do not have the actual agreement between Oracle and the Bank of America entities (yet), it appears from public filings that Oracle monetizes the payment stream almost on day one, mitigating its own financial exposure for failed implementations and leaving customers with an ongoing obligation to a bank that claims it bears no responsibility for Oracle's performance. The practical effect of this arrangement is to exert enormous pressure on the Oracle customer&mdash;it finds itself fighting a battle on the one hand to get Oracle to right the project and deliver the promised solution, and on the other it faces a possible collections action and a hit to its credit. &nbsp;Third party banks pressing for payment give Oracle leverage in settlement discussions with its customer. &nbsp;This creates cash flow pressure and a tactical advantage for Oracle. &nbsp;The clause shifts risk and inconvenience to the customer but doesn't eliminate their legal rights against Oracle &mdash; it just makes exercising those rights more expensive and burdensome.&nbsp;<br /><br />The question California courts must answer is whether that arrangement is actually enforceable. Legal arguments exist that it may not be.<br /><br /><font color="#da8044">What the Clause Actually Says</font><br />We are able to ascertain the language of the typical OCC Payment Plan Agreement from public court filings. &nbsp;Here is a screenshot of the actual clause, which was a part of an exhibit to a Complaint brought by BALC against an Oracle customer.<br /><br />&#8203;<br />&nbsp;<br />BALC's litigation position rests entirely on that clause. Its argument is that the customer contractually waived every defense it could ever raise against Oracle &mdash; fraud, breach of contract, failure to deliver &mdash; and that BALC, as assignee, is entitled to enforce that waiver. In legal terms, BALC is claiming the functional equivalent of "holder in due course" status: the right to collect a payment obligation free from any defense related to the underlying transaction. And indeed that is the argument that some of these Oracle assignees have raised in litgation against Oracle customers. Although the Oracle customer can still assert defenses in litigation against Oracle, it shifts the burden to the customer. &nbsp;It makes it risky for the customer to stop paying when Oracle fails to perform and thereby puts Oracle in the driver&rsquo;s seat.<br /><br />However, BALC&rsquo;s argument may fail under California law for at least five independent reasons.<br /><br /><font color="#da8044">Why the Clause May Not Hold Up</font><br />The statute that could save BALC expressly requires good faith and lack of notice &mdash; conditions BALC cannot meet.<br /><br />California Commercial Code Section 9403 governs exactly this situation: waiver-of-defense clauses in assigned financing agreements. It makes such clauses enforceable by an assignee, but only if that assignee took the assignment for value, in good faith, and without notice of the defense being waived. This is not a loophole &mdash; it is the core of the statute.<br /><br />&#8203;BALC has filed over 60 collection actions against Oracle customers arising from Oracle/OCC assignments in San Mateo County Superior Court alone. Multiple court cases, legal industry publications, and news coverage appear to document Oracle's pattern of overselling NetSuite's capabilities and failing to deliver working implementations. By no later than 2021, any institutional lender systematically acquiring OCC assignments had access to &mdash; and reason to know of &mdash; that pattern. That is because when the banks try to collect the customers explain that Oracle failed to deliver a working system, and the customers tell that directly to BALC or BANA when they try to enforce the assignment. &nbsp;The response&mdash;too bad. Pay anyway or face a contract where payments have been accelerated and a collections action. Under these circumstances where the banks are aware of a multitude of implementation failures with multiple Oracle clients claiming fraud, it makes any argument that these banks were innocent strangers to the transaction seem implausible. The statute that would make the clause work against customers may expressly deny the banks the benefit of it.<br /><br /><font color="#da8044">California Civil Code Section 1668 voids any clause that purports to exempt a party from its own fraud.</font><br />This statute is unambiguous: contracts that have the object, directly or indirectly, of exempting anyone from responsibility for their own fraud are against the policy of California law and are void. If Oracle's sales representatives misrepresented NetSuite's capabilities as multiple Plaintiffs in lawsuits against Oracle contend, then a clause in a subsidiary's financing agreement that requires the customer to keep paying regardless of that fraud is precisely what Section 1668 prohibits. OCC is either a subsidiary or affiliate of Oracle. BALC is OCC's assignee. Neither can stand at a greater legal distance from Oracle's fraud than Oracle itself.<br /><br /><font color="#da8044">The clause was procured through the same fraud it purports to waive.</font><br />Even setting aside public policy, a contractual waiver signed under the influence of fraudulent misrepresentation is itself voidable. No rational businessperson agrees, in the abstract, to pay in full for software that is never delivered. Court cases allege that customers signed these agreements because Oracle's representatives told them the implementation would succeed, that the SuiteSuccess methodology was proven, and that their industry's needs would be met out of the box. Oracle customers have alleged that those representations were false. If the entire contract &mdash; including the embedded waiver clause &mdash; was induced by that fraud, California law allows customers to rescind it on that basis.<br /><br /><font color="#da8044">The clause is unconscionable.</font><br />California Civil Code Section 1670.5 allows courts to refuse to enforce a contract clause that was unconscionable at the time it was made. Arguments can be made that the "hell or high water" clause satisfies both requirements. Procedurally, it appears in a pre-printed, non-negotiable financing form presented to a small or mid-sized business by one of the world's largest software companies at the tail end of a long DocuSign &mdash; there is no meaningful opportunity to negotiate. Substantively, a clause requiring unconditional payment even in the face of fraud, total non-performance, and a completely non-functional ERP system is so one-sided that it eliminates the most basic protection a contracting party has: the right to withhold payment when the other party doesn't perform.<br /><br />California's Supreme Court has held that the more substantively oppressive a clause, the less procedural unconscionability is needed to strike it down. This clause is arguably about as substantively oppressive as commercial contract terms get.<br />Enforcing the clause would constitute unjust enrichment.<br /><br />&#8203;California does not permit a party to be enriched at the expense of another under circumstances where it would be unjust to retain the benefit. Allowing BALC to collect the full contract price for software that was never implemented &mdash; while the customer simultaneously had to find and pay for an alternative ERP system &mdash; would give Oracle and BALC the economic benefit of a transaction whose only consideration was never delivered. That is textbook unjust enrichment, and California law provides equitable remedies for it.<br /><br /><font color="#da8044">The Broader Picture</font><br />These five arguments are not alternative theories of the same claim &mdash; they are independent, stacking grounds for relief, each sufficient on its own. Together, they reflect a California legal framework that has never been designed to let one contracting party use a subsidiary and an affiliated bank to insulate itself from the financial consequences of its own fraud and breach.<br /><br />The "hell or high water" clause is not meaningless in every context. If Oracle delivered a working implementation and the customer simply regretted the purchase, the clause would likely hold. But in the case of systematic misrepresentation, total implementation failure, and an assignee that knew exactly what it was collecting on, California law provides customers with a robust set of defenses &mdash; statutory, contractual, and equitable &mdash; to attack the provision.<br /><br />Businesses receiving collection demands from Banc of America Leasing &amp; Capital or Bank of America, N.A., arising from Oracle NetSuite financing agreements should not assume that the presence of this clause in their contract means they have no options. The law in California is more protective than Oracle and BALC's litigation posture suggests.<br /><br /><em><font color="#da8044">Tactical Law advises companies in disputes with Oracle assignees over failed Oracle ERP contracts.</font></em></strong><br /><br /></div> <hr style="width:100%;clear:both;visibility:hidden;"></hr>]]></content:encoded></item><item><title><![CDATA[The Oracle Audit Playbook Exposed]]></title><link><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/the-oracle-audit-playbook-exposed]]></link><comments><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/the-oracle-audit-playbook-exposed#comments]]></comments><pubDate>Sat, 07 Mar 2026 14:56:16 GMT</pubDate><category><![CDATA[Uncategorized]]></category><guid isPermaLink="false">https://www.tacticallawgroup.com/oracle-software-audit-blog/the-oracle-audit-playbook-exposed</guid><description><![CDATA[By Pam FulmerYour company receives a letter from Oracle&rsquo;s License Management Services. It is politely worded but unmistakably serious. Oracle is exercising its contractual audit rights and would like your organization to cooperate in a review of your software deployments.For many companies, the instinct at this moment is to cooperate fully, correct any genuine issues, and resolve the matter quickly. That instinct, while understandable, is exactly what Oracle is counting on.&#8203;What foll [...] ]]></description><content:encoded><![CDATA[<div class="paragraph"><strong><font size="4">By Pam Fulmer</font><br /><br /><em>Your company receives a letter from Oracle&rsquo;s License Management Services. It is politely worded but unmistakably serious. Oracle is exercising its contractual audit rights and would like your organization to cooperate in a review of your software deployments.</em><br /><br />For many companies, the instinct at this moment is to cooperate fully, correct any genuine issues, and resolve the matter quickly. That instinct, while understandable, is exactly what Oracle is counting on.<br />&#8203;<br />What follows the audit letter is not a neutral compliance review. It is the opening move in a carefully engineered revenue strategy that Oracle&rsquo;s own employees have described in federal court filings as &ldquo;Audit, Bargain, Close&rdquo; &mdash; or ABC. Understanding how this strategy works, what rights you actually have, and how experienced legal counsel can level the playing field is the difference between a six-figure settlement on your terms and an eight-figure capitulation on Oracle&rsquo;s.<br />&nbsp;</strong><br /><strong><font size="4" color="#3387a2">The &ldquo;Audit, Bargain, Close&rdquo; Strategy: What We Know from Court Records</font><br /><br />&#8203;</strong><strong>The term &ldquo;Audit, Bargain, Close&rdquo; did not originate with Oracle&rsquo;s critics. It originated inside Oracle itself. In a class action securities lawsuit against Oracle, a consolidated complaint alleged, based on statements from nine former Oracle employees identified with specificity, that Oracle systematically used coercive audit practices to manufacture cloud subscription revenue.<br />&#8203;<br /><em>&ldquo;The sales team would identify large clients they thought they could get more money out of and threaten them with audits&hellip; frequently, neither sales nor LMS had real evidence that customers targeted for audits were noncompliant, but the mere threat of an audit would put customers under so much pressure that they had no choice but to agree to Oracle&rsquo;s demands.&rdquo; &mdash; Former Oracle Employee, Federal Court Filing</em><br /><br />This is not a fringe allegation. The complaint describes in granular detail a system in which Oracle&rsquo;s License Management Services (LMS) also know as Global License Advisory Services (GLAS) &mdash; the internal audit arm &mdash; and Oracle&rsquo;s sales division operated in close coordination, with sales identifying audit targets and, in some cases, drafting the threatening audit letters that LMS then sent to customers. A federal court allowed the case to proceed on a narrow securities fraud theory, finding the allegations legally sufficient to state a plausible claim.<br /><br /><font size="4" color="#3387a2">The three phases of the strategy, along with what your company should do, break down as follows:</font><br />&nbsp;<br /><font color="#3387a2">AUDIT</font><br />Sales/LMS identify target accounts &mdash; often with no real evidence of non-compliance. Soft audit inquiry or formal LMS letter sent.<br /><br />Do not respond informally. Retain legal counsel immediately. Channel all communications through a single designated contact.<br /><br /><font color="#3387a2">BARGAIN</font><br />Oracle presents inflated "shock number" compliance gap, then offers a "discount" if you purchase cloud subscriptions or a ULA.<br /><br />Challenge the methodology. Independently verify all findings. Do not accept Oracle's numbers without scrutiny &mdash; they are frequently overstated.<br /><br /><font color="#3387a2">CLOSE</font><br />Oracle leverages quarter-end deadlines and fear of copyright litigation to pressure a fast settlement on its terms.<br /><br />Understand Oracle's fiscal calendar. Deadlines are artificial. A settlement built around your legal position is far stronger than one built around Oracle's timeline.<br /><br />The result: customers who should never have faced a compliance bill pay millions. And Oracle books it as cloud revenue growth.<br />&nbsp;</strong><br /><strong><font size="4" color="#3387a2">Five Oracle Audit Tactics Your Legal Team Needs to Know</font></strong><br /><br /><strong>1. The &ldquo;Soft Audit&rdquo; Disguised as a Friendly Review</strong><br /><br /><strong>Not all Oracle audit pressure arrives with a formal LMS letter. Oracle also deploys what the industry calls &ldquo;soft audits&rdquo; &mdash; informal outreach from Oracle sales representatives framed as a complimentary license review, a compliance health check, or even an account management call. &nbsp;This is what is going on when you get a call from Oracle about your Java SE deployments.<br /><br />In practice, an informal review carries no contractual audit protections for the customer. There are no defined timelines, no scope limitations, and no formal dispute rights. Customers who participate under the impression that they have &ldquo;nothing to hide&rdquo; frequently discover that Oracle&rsquo;s sales team has collected enough data to generate a large compliance claim &mdash; and a cloud subscription proposal to resolve it.<br /><br /><em>Legal note: You are not obligated to cooperate with an informal Oracle review. Only a formal audit notice from Oracle&rsquo;s LMS or legal counsel invokes your contractual audit obligations. Treat any Oracle compliance outreach as potentially adversarial until you have reviewed your contract and consulted counsel.</em></strong><br /><br /><strong>2. The &ldquo;Shock Number&rdquo;: How Oracle Builds Its Opening Position</strong><br /><br /><strong>When Oracle&rsquo;s LMS presents audit findings, the initial compliance gap figure is almost always dramatically overstated. This is not an accident. Oracle&rsquo;s auditors appear to be incentivized to identify maximum potential exposure, and they routinely rely on non-contractual policies &mdash; particularly the Oracle Partitioning Policy governing VMware virtualization &mdash; as if those policies were binding contractual terms.<br /><br />The Oracle Partitioning Policy states that Oracle software running in a VMware environment must be licensed for every physical processor core in the entire cluster, not just the hosts where Oracle is actually deployed. This policy is not part of Oracle&rsquo;s standard Master License Agreement. It is a unilaterally published document that explicitly states it &ldquo;may not be incorporated into any contract&rdquo; and is subject to change without notice. Yet Oracle&rsquo;s auditors apply it as if customers agreed to it.<br /><br />The practical effect: a company running Oracle database on three hosts in a forty-host VMware cluster may receive an audit claim demanding licenses for all forty hosts. The shock number exists to make the eventual settlement &mdash; which might only cover the three actual hosts &mdash; feel like a victory for the customer, even if the customer overpays relative to its genuine contractual obligations.<br /><br /><em>Legal note: Oracle&rsquo;s non-contractual policies cannot expand your license obligations beyond what your actual signed agreements require. A detailed legal analysis of your specific Oracle contracts is essential before responding to any audit findings.</em></strong><br /><br /><strong>3. Java SE: The New Enforcement Frontier</strong><br /><br /><strong>Oracle&rsquo;s Java enforcement activity represents one of the most significant changes in the enterprise software audit landscape since 2023. Following Oracle&rsquo;s shift to a per-employee Java SE subscription model, Oracle launched an aggressive global campaign to identify organizations using Oracle&rsquo;s Java Development Kit without the required commercial subscription.<br /><br />Oracle tracks Java downloads by matching IP addresses to organizations. Companies are being contacted for Java compliance regardless of whether they have any other Oracle products. Gartner has projected that by 2026, at least one in five organizations using Java will face an Oracle audit. Oracle has been targeting companies with as few as fifty employees purely over Java usage, and the pricing model &mdash; applied per employee across the entire organization regardless of actual Java use &mdash; can produce cost increases exceeding 800 percent compared to prior licensing structures.<br /><br />&#8203;Java audits follow the same ABC pattern. The soft audit begins with an inquiry from Oracle&rsquo;s Java sales team, often referencing Oracle&rsquo;s download records as evidence of non-compliance. Or the Oracle team says that they are there&nbsp;to help you ensure that your data is secure. Organizations that respond without counsel frequently provide far more information than their contracts require, which Oracle then uses to build a large non-compliance claim.<br /><br /><em>Legal note: Oracle&rsquo;s per-employee Java pricing model has been challenged as an overreach relative to actual usage. Companies may have grounds to contest both the scope of Oracle&rsquo;s audit claims and the retroactive fee demands that frequently accompany them.</em></strong><br /><br /><strong>4. The Quarter-End Close Pressure</strong><br /><br /><strong>Oracle&rsquo;s fiscal year ends on May 31. Its quarterly deadlines follow this calendar (August 31, November 30, and then February 28). Oracle&rsquo;s audit and sales teams know this calendar intimately, and they use it deliberately.<br /><br />&#8203;As Oracle approaches a quarter-end, the pressure on audit targets intensifies. Proposals that were presented as final become &ldquo;special offers&rdquo; with deadline language. Sales teams become more accessible. Discounts appear. The implicit message is that the deal available today will not be available next week.<br /><br />These deadlines are artificial. Oracle&rsquo;s contractual audit rights do not expire at quarter-end. The &ldquo;deal&rdquo; usually does not evaporate but comes back the next quarter and is often better. What Oracle is doing is leveraging its own internal sales cycle against you &mdash; creating urgency that has no legal foundation but enormous psychological effect on companies that are not prepared for it.<br /><br /><em>Legal note: Any settlement offer involving Oracle cloud subscriptions, Unlimited License Agreements, or license true-ups should be reviewed carefully by experienced licensing counsel before signature. Settlements signed under artificial deadline pressure often contain terms that create new and expensive obligations for years afterward.</em></strong><br /><br /><strong>5. Default-Enabled Features: The Trap Oracle Installs for You</strong><br /><br /><strong>Court filings in Oracle related litigation include an allegation: that Oracle configured its on-premises software products to automatically install additional options and management packs in an enabled state, without informing customers that these features were active or that using them required additional licenses. Once a customer was found &ldquo;using&rdquo; these features &mdash; even unknowingly &mdash; Oracle&rsquo;s LMS had a basis for a compliance claim.<br /><br />This pattern is most prevalent with Oracle Database Enterprise Edition, which ships with a wide range of options &mdash; Partitioning, Advanced Security, Diagnostics Pack, Tuning Pack, and others &mdash; that require separate licenses. Database administrators frequently enable features or run queries that inadvertently activate options. Oracle&rsquo;s LMS audit scripts are designed to identify these activations, which Oracle treats as evidence of unlicensed use regardless of whether the customer had any knowledge or intent.<br /><br /><em>Legal note: Unintentional feature activation is a common and frequently challenged basis for Oracle audit claims. The fact that a feature was activated does not necessarily mean a license was required or that the customer is liable for retroactive fees. These findings are defensible with the right technical and legal analysis.</em><br />&nbsp;</strong><br /><strong><font size="4" color="#3387a2">Oracle Is Not Alone: Quest Software and the Growing Audit Threat</font></strong><br /><br /><strong>Oracle is the most prominent practitioner of aggressive software audit tactics, but it is not the only one. Quest Software &mdash; which makes widely-used database tools including Toad, Spotlight, and a range of products that manage Oracle and SQL Server environments &mdash; has adopted audit strategies that closely mirror Oracle&rsquo;s playbook.<br /><br />Quest&rsquo;s audit activity frequently targets organizations that use Quest tools in virtualized environments or across shared infrastructure, asserting broad license obligations based on deployment configurations that customers did not understand to trigger additional license requirements. Quest, like Oracle, tends to present inflated initial findings and then offer to resolve the matter through subscription upgrades or expanded license purchases.<br />&nbsp;</strong><br /><strong><font size="4" color="#3387a2">What Oracle Doesn&rsquo;t Want You to Know: Your Contractual Rights</font></strong><br /><br /><strong>Oracle&rsquo;s audit process is designed to feel inevitable and one-sided. It is neither. Your Oracle Master Agreement contains specific provisions that define and limit Oracle&rsquo;s audit rights, and those provisions exist to protect you. Key rights that companies frequently overlook include:</strong><ul><li><strong>Notice requirements. Oracle is typically required to provide written advance notice before initiating a formal audit. The required notice period &mdash; often 45 days &mdash; is a minimum, not a maximum. You are entitled to the full notice period to prepare.</strong></li><li><strong>Scope limitations. Your contract defines what Oracle can audit and how. Oracle&rsquo;s LMS scripts collect significant data, and you are not required to run those scripts beyond the scope your contract specifies. Reviewing the script output before providing it to Oracle is both prudent and entirely appropriate.</strong></li><li><strong>Audit frequency limits. Many Oracle agreements include provisions limiting how frequently Oracle can conduct audits. If you have been recently audited, Oracle may not have the right to initiate another review.</strong></li><li><strong>The non-contractual policy problem. If Oracle&rsquo;s compliance claim relies on the Partitioning Policy,&nbsp;or any other policy document that is not expressly incorporated into your signed agreements, you have grounds to challenge that claim. Policy documents that Oracle unilaterally publishes and reserves the right to change cannot override what your contract actually says.</strong></li></ul> <strong>&nbsp;<br /><em>One of the most important things you can do in an Oracle audit is to understand what you agreed to &mdash; not what Oracle says you agreed to. Those are frequently very different things.</em></strong><br /><br /><strong><font size="4" color="#3387a2">What to Do Before Oracle Comes Knocking: A Practical Framework&nbsp;</font></strong><strong><font size="4"><font color="#3387a2">Before the Audit Letter:</font></font><br /><br />Proactive Steps</strong><ul><li><strong>Conduct an internal license baseline. Understand what Oracle products you are running, where they are deployed, and what your contracts actually say. Knowing your position before Oracle does is the single most powerful advantage in an audit.</strong></li><li><strong>Review your Oracle contracts for audit rights, frequency limitations, and scope provisions. Many organizations have never read these sections carefully. They matter enormously.</strong></li><li><strong>Document your VMware environment and Oracle software deployment boundaries. If Oracle is not installed on certain hosts or clusters, document that technically. Clean documentation is the foundation of a strong audit defense.</strong></li><li><strong>Identify which Oracle products might have default-enabled features in your environment. If your DBAs have been running the Diagnostics Pack or Tuning Pack without realizing it, you want to know that before Oracle does.</strong></li><li><strong>Establish a relationship with experienced Oracle licensing counsel before you need them. The cost of a proactive assessment is a fraction of the cost of responding to an audit without one.</strong></li></ul> <strong>&nbsp;</strong><br /><strong>When the Letter Arrives: Immediate Response</strong><ul><li><strong>Do not respond to Oracle directly without counsel. Every statement you make becomes part of Oracle&rsquo;s record. The first communication from your organization should be one that establishes the rules of engagement, not one that provides Oracle with data.</strong></li><li><strong>Distinguish between a soft audit and a formal LMS notice. If Oracle&rsquo;s outreach is informal, you are not obligated to cooperate in the same way as with a formal audit. Treating a sales inquiry as a binding audit obligation is a mistake that Oracle actively encourages.</strong></li><li><strong>Establish a single point of contact. All Oracle audit communications should flow through one person &mdash; ideally legal counsel or someone working directly with counsel. Prevent Oracle from speaking informally with your IT staff, who may inadvertently disclose information that strengthens Oracle&rsquo;s position.</strong></li><li><strong>Review the LMS scripts before running them. Oracle&rsquo;s data collection tools are designed to capture maximum information. Have your technical and legal teams review what the scripts collect and limit the output to what your contract requires.</strong></li><li><strong>Record everything in writing. Verbal representations from Oracle sales or LMS teams are notoriously unreliable. Every commitment, every deadline, every proposed settlement term should be in writing.</strong></li></ul> <strong>&nbsp;</strong><br /><strong>During Negotiations: Protecting Your Position</strong><ul><li><strong>Challenge Oracle&rsquo;s findings independently. Oracle&rsquo;s initial numbers are a starting position, not a final determination. Engage your own technical analysis of what the data actually shows before accepting any characterization of non-compliance.</strong></li><li><strong>Separate genuine compliance gaps from manufactured ones. If you have real license deficiencies, address them. If Oracle&rsquo;s claim relies on non-contractual policies or overreaching interpretations of your environment, push back aggressively.</strong></li><li><strong>Understand Oracle&rsquo;s fiscal calendar. Deadlines that appear before Oracle&rsquo;s May 31 year-end or quarterly closes are not coincidental. You are not bound by Oracle&rsquo;s revenue calendar.</strong></li><li><strong>Be skeptical of cloud subscription settlement proposals. Purchasing Oracle Cloud licenses as a way to resolve an audit claim is, in many cases, purchasing something you do not need to escape a claim that was overstated to begin with. If a cloud subscription actually serves your business, that is a separate analysis &mdash; but it should be conducted on its own merits, not under audit pressure.</strong></li></ul> <strong>&nbsp;</strong><br /><strong><font size="4" color="#3387a2">The Bottom Line: Knowledge Is the Most Powerful Audit Defense</font></strong><br /><br /><strong>Oracle&rsquo;s &ldquo;Audit, Bargain, Close&rdquo; strategy works because most organizations are unprepared for it. They do not know what their contracts say. They do not understand that Oracle&rsquo;s non-contractual policies are not legally binding. They do not realize that the shock number is designed to be challenged. They respond to artificial urgency with real concessions.<br />The companies that fare best in Oracle audits &mdash; and in the audits conducted by Quest, IBM, Microsoft, and other aggressive publishers &mdash; share a common characteristic: they treat the audit as a legal matter from the first contact, not from the moment they have already provided the publisher with everything it needs to build its case.<br /><br />Our firm has represented companies across a wide range of industries in Oracle and other audit defense, Oracle and NetSuite ERP litigation, and disputes with other enterprise software publishers. We understand these audit playbooks in depth &mdash; including the contractual arguments that work, the technical defenses that matter, and the negotiating strategies that achieve real outcomes.<br /><br />If your organization has received an Oracle audit letter or an informal inquiry about Java &mdash; or if you want to understand your exposure before one arrives &mdash; we invite you to contact us for a confidential consultation.<br />&nbsp;</strong></div>]]></content:encoded></item><item><title><![CDATA[How Oracle’s Sales Model Creates ERP Failure Risk]]></title><link><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/how-oracles-sales-model-creates-erp-failure-risk]]></link><comments><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/how-oracles-sales-model-creates-erp-failure-risk#comments]]></comments><pubDate>Thu, 22 Jan 2026 11:52:19 GMT</pubDate><category><![CDATA[Uncategorized]]></category><guid isPermaLink="false">https://www.tacticallawgroup.com/oracle-software-audit-blog/how-oracles-sales-model-creates-erp-failure-risk</guid><description><![CDATA[By Pam Fulmer&#8203;Failed ERP implementations are often described as &ldquo;project problems.&rdquo; Oracle reinforces this framing, pointing to implementation partners, change management challenges, or customer indecision. That narrative is convenient&mdash;and misleading. In many NetSuite SuiteSuccess or Oracle Fusion disputes, the root cause of failure is not poor execution. It is how Oracle sells ERP systems in the first place. The sales model itself creates predictable legal and operationa [...] ]]></description><content:encoded><![CDATA[<div class="paragraph"><br /><strong><font size="4">By Pam Fulmer</font><br />&#8203;</strong><br /><strong>Failed ERP implementations are often described as &ldquo;project problems.&rdquo; Oracle reinforces this framing, pointing to implementation partners, change management challenges, or customer indecision. That narrative is convenient&mdash;and misleading. In many NetSuite SuiteSuccess or Oracle Fusion disputes, the root cause of failure is not poor execution. It is how Oracle sells ERP systems in the first place. The sales model itself creates predictable legal and operational risk, long before the first data is migrated.<br /><br />Understanding that model is critical for executives and in-house counsel assessing litigation risks and rewards, contract termination scenarios, or settlement strategy with Oracle.<br />This blog post is based on a review of actual litigation filed against Oracle involving its ERP software and failed ERP implementations to demonstrate Oracle&rsquo;s playbook and identify common themes across the disputes.<br /><br /><font color="#3387a2">Oracle Sells Certainty&mdash;While Structurally Avoiding Accountability</font><br /><br />Oracle&rsquo;s ERP sales strategy is built around a fundamental tension:</strong><ul><li><strong>Promise certainty to close the deal</strong></li><li><strong>Disclaim responsibility once the deal closes</strong></li></ul> <strong> During the sales cycle, Oracle positions itself as a trusted business advisor and often leads solution design discussions.&nbsp;From these discussions, Oracle identifies required modules. Oracle sales represent that by purchasing this specific set of modules, the customer&rsquo;s requirements discussed during the sales cycle can be met. Oracle markets NetSuite SuiteSuccess and Oracle Fusion as integrated, proven solutions and emphasizes speed, standardization, and reduced risk.<br /><br />After contract execution, and once disputes arise, Oracle abruptly changes its posture.&nbsp;&nbsp;Oracle claims it merely licensed the software and points to implementation partners as the reason for the failures.&nbsp;&nbsp;Then Oracle relies on contractual disclaimers in its Subscription Services Agreement (&ldquo;SSA&rdquo;) to attempt to avoid responsibility.&nbsp;&nbsp;Many customers are unaware of the SSA, which is the governing agreement because it is buried in a disguised and grayed out hyperlink on the Estimate Form.<br />This structural disconnect is not incidental&mdash;it is the core of many ERP disputes.<br /><br /><font color="#3387a2">The Modular Sales Trap: Selling Pieces as a &ldquo;Solution&rdquo;<br />&#8203;</font><br />Oracle sells ERP systems as bundled modules, while contractually treating each module as an isolated product. From a business perspective, customers are told the modules work together seamlessly, the configuration supports their industry, and the ERP will deliver defined operational outcomes.<br /><br />Once a dispute arises and from a legal perspective, Oracle later argues that each module stands alone and that the integration risk belongs to the customer and the customer was solely responsible in determining whether the solution is fit for its business.&nbsp;<br /><br />When the combined system does not function as promised, Oracle characterizes the failure as implementation error rather than solution design failure, even when Oracle itself selected the architecture.<br /><br /><font color="#3387a2">SuiteSuccess: Speed as a Sales Weapon, Not a Delivery Reality</font><br /><br />SuiteSuccess is Oracle&rsquo;s most aggressive example of sales-driven risk. It is marketed as:</strong><ul><li><strong>Industry-specific</strong></li><li><strong>Preconfigured</strong></li><li><strong>Faster to deploy</strong></li><li><strong>Lower risk than traditional ERP</strong></li></ul> <strong> In practice, many SuiteSuccess failures arise because the standardized configuration does not match real-world operations, critical functionality is missing or immature, extensive customization is required despite promises to the contrary, and the timeline was unrealistic from the outset.&nbsp;&nbsp;Plaintiffs in these cases against Oracle claim that Oracle used high pressure sales tactics to close the deal, but that Oracle&rsquo;s scoping was inadequate and incomplete and risks were either minimized or omitted all together.<br />&#8203;<br /><font color="#3387a2">The Partner Buffer: Shifting Risk Without Reducing It</font><br /><br />It appears that&nbsp;Oracle&rsquo;s heavy reliance on implementation partners is not merely operational&mdash;it is strategic. Partners allow Oracle to:</strong><ul><li><strong>Accelerate sales without staffing delivery</strong></li><li><strong>Shift execution risk downstream</strong></li><li><strong>Preserve subscription revenue regardless of outcome</strong></li></ul> <strong> But this structure does not eliminate risk&mdash;it redistributes it to the customer.<br /><br />However, in many disputes Oracle selected or strongly influenced the choice of partner and relied on partner participation to close the deal during the sales cycle.&nbsp;&nbsp;But once the deal closed and problems arise, Oracle disclaims all responsibility for the partner&rsquo;s performance. This creates a risk vacuum, where Oracle controls the sale, the partner controls execution, and the customer bears the consequences when the system fails.<br /><br /><font color="#3387a2">Information Asymmetry: Oracle Knows More Than It Tells</font><br />&#8203;<br />One of the most overlooked aspects of Oracle ERP disputes is information asymmetry.<br />Oracle typically knows how often similar implementations fail and which configurations break down.&nbsp;&nbsp;Oracle also has knowledge of which modules are immature or unstable and how dependent success is on customization. Customers do not know these things and rely on Oracle&rsquo;s greater expertise and knowledge.<br /><br />When Oracle sells ERP solutions without disclosing known risks&mdash;or affirmatively minimizes them&mdash;it creates fertile ground for claims based on misrepresentation and concealment.<br />ERP litigation often turns on what Oracle knew, when it knew it, and how much of that information was withheld during the sales cycle.<br /><br /><font color="#3387a2">Why These Disputes Are Predictable&mdash;and Repeatable</font><br /><br />The same patterns appear across publicly filed Oracle NetSuite and Fusion disputes:</strong><ul><li><strong>Aggressive sales timelines</strong></li><li><strong>High pressure sales tactics including the threat that deep discounts will disappear if the deal is not closed on Oracle&rsquo;s timeline</strong></li><li><strong>Overstated functionality by Oracle sales personnel during the sales cycle</strong></li><li><strong>Partner dependency and customization risk downplayed or not mentioned at all</strong></li><li><strong>Risk shifted contractually after the fact</strong></li></ul> <strong> Then after the contract is signed and the customer encounters severe implementation problems similar patterns emerge.</strong><ul><li><strong>If Oracle is doing the implementation, frequent personnel changes that lead to loss of knowledge and inefficiency</strong></li><li><strong>Language barriers with the offshore Oracle team</strong></li><li><strong>Additional third-party software must be purchased to achieve promised functionality</strong></li><li><strong>Costs escalate and balloon well over initial estimates</strong></li><li><strong>Oracle or its assignee enforces subscription payments despite failures and inability to deliver an operational system</strong></li></ul> <strong> These are not one-off anomalies. They are the natural byproduct of a sales model that prioritizes closing deals over the feasibility of delivering the promised functionality. From a legal standpoint, predictability strengthens customer claims&mdash;it undermines Oracle&rsquo;s argument that failure was unforeseeable or partner-specific.<br /><br /><font color="#3387a2">What Executives and In-House Counsel Should Take From This</font><br /><br />When an Oracle ERP fails, the most important question is not:<br />&ldquo;What went wrong during implementation?&rdquo;<br />It is:<br />&ldquo;Was this system ever realistically capable of delivering what Oracle sold?&rdquo;<br />That question reframes the dispute from project management to sales conduct, risk disclosure, and solution viability&mdash;where Oracle is far more exposed.<br /><br /><font color="#3387a2">The Bottom Line</font><br /><br />Oracle ERP failures are often not execution mistakes. They are sales-driven failures, rooted in a business model that appears based on the filed cases to separate promise from accountability.<br />For companies facing NetSuite or Oracle Fusion disputes, recognizing this reality early can fundamentally change:</strong><ul><li><strong>Litigation strategy</strong></li><li><strong>Termination leverage</strong></li><li><strong>Damage recovery</strong></li><li><strong>Settlement dynamics</strong></li></ul> <strong> <font color="#3387a2">Final Thought: ERP Risk Is Created Long Before Go-Live</font><br /><br />By the time an ERP fails in production&mdash;or never reaches go-live&mdash;the legal issues are already baked in. They were created during the sales cycle, not the implementation phase.<br />Companies that understand Oracle&rsquo;s sales model are far better positioned to challenge Oracle&rsquo;s defenses&mdash;and to avoid funding a failed ERP indefinitely.<br /><br />During the sales cycle it is important to document Oracle&rsquo;s promises in emails and other communications.&nbsp;&nbsp;Oracle&rsquo;s playbook of setting up Zoom calls to do the scoping and requirements gathering often does not leave a paper trail. Oracle customers must create one, and they must preserve carefully these pre-contract communications made by Oracle during the sales cycle.<br /><br />Our attorneys advise clients on strategies to resolve disputes with Oracle and its partners when a NetSuite SuiteSucces or Oracle Fusion project goes off the rails.</strong><br /><br /></div>]]></content:encoded></item><item><title><![CDATA[Oracle Java Licensing Enforcement: How “Friendly Outreach” Is Driving Significant Compliance Risk]]></title><link><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/oracle-java-licensing-enforcement-how-friendly-outreach-is-driving-significant-compliance-risk]]></link><comments><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/oracle-java-licensing-enforcement-how-friendly-outreach-is-driving-significant-compliance-risk#comments]]></comments><pubDate>Wed, 21 Jan 2026 13:10:54 GMT</pubDate><category><![CDATA[Uncategorized]]></category><guid isPermaLink="false">https://www.tacticallawgroup.com/oracle-software-audit-blog/oracle-java-licensing-enforcement-how-friendly-outreach-is-driving-significant-compliance-risk</guid><description><![CDATA[By Pam FulmerAcross industries, companies are increasingly reporting a common pattern in Oracle&rsquo;s approach to Java licensing. What often begins as a polite, informal inquiry about Java usage can quickly escalate into a high-dollar compliance demand&mdash;sometimes reaching into the millions of dollars&mdash;followed by pressure to purchase enterprise-wide Java subscriptions.Often in house counsel is not even aware that Oracle has reached out to various IT personnel.&nbsp;&nbsp;They only be [...] ]]></description><content:encoded><![CDATA[<div class="paragraph"><strong><font size="4">By Pam Fulmer</font><br /><br />Across industries, companies are increasingly reporting a common pattern in Oracle&rsquo;s approach to Java licensing. What often begins as a polite, informal inquiry about Java usage can quickly escalate into a high-dollar compliance demand&mdash;sometimes reaching into the millions of dollars&mdash;followed by pressure to purchase enterprise-wide Java subscriptions.<br /><br />Often in house counsel is not even aware that Oracle has reached out to various IT personnel.&nbsp;&nbsp;They only become aware when a multi-million dollar licensing demand is escalated to the legal department.&nbsp;&nbsp;And then much of the damage has already been done.<br />&#8203;<br />Oracle is able to identify organizations that have downloaded or deployed Java.&nbsp;&nbsp;An Oracle Java team member initiates contact under the guise of a routine security or licensing discussion, and then leverages information voluntarily provided by the company to assert noncompliance. The risk is compounded by Oracle&rsquo;s revised Java subscription model, which can dramatically increase licensing exposure based on employee headcount rather than actual Java usage.<br /><br />&#8203;This article explains what is happening in the Java licensing marketplace, why so many companies are caught off guard, and what organizations should do now to reduce risk before Oracle comes calling. And if Oracle is already on your door step, our law firm assists companies in resolving disputes with Oracle over Java.</strong><br /><br /><strong><font color="#3387a2">Oracle&rsquo;s Shift From Traditional Audits to &ldquo;Soft&rdquo; Java Enforcement</font></strong><br /><br /><strong>Historically, software compliance disputes began with a formal audit letter invoking contractual audit rights. Oracle&rsquo;s current Java enforcement model looks very different.<br />Many organizations now report receiving:</strong><ul><li><strong>A cordial email requesting a short call about Java licensing</strong></li><li><strong>A message asking the company to &ldquo;confirm Java usage&rdquo;</strong></li><li><strong>A discussion framed around Java security updates or licensing alignment</strong></li></ul> <strong>These communications rarely mention audits, noncompliance, or breach. As a result, they are often routed to IT teams or handled informally. That initial informality is precisely what creates risk, and is probably why Oracle chooses this path in order to avoid the legal department and to get to the information that it wants so it can claim a huge non-compliance gap before management or legal even knows about the outreach.<br /><br />Once Oracle receives deployment information, the engagement often escalates quickly&mdash;sometimes moving from a casual inquiry to a significant financial claim within days or weeks.</strong><br /><strong><font color="#3387a2"><br />How Oracle Identifies Java Users</font></strong><br /><br /><strong>A common misconception is that only companies with existing Oracle contracts are exposed to Java audits. In reality, Oracle&rsquo;s Java licensing enforcement extends well beyond traditional Oracle customers.<br /><br />Oracle has visibility into Java activity through various touchpoints, including downloads obtained through Oracle-controlled distribution channels. When Java is downloaded using identifiable credentials or corporate domains, Oracle can associate that activity with a specific organization.<br /><br />This is why companies that believe they &ldquo;do not use Oracle software&rdquo; or &ldquo;have never purchased Java&rdquo; are often surprised to receive settlement demands from Oracle. From Oracle&rsquo;s perspective, download activity alone may be sufficient to justify initiating a licensing discussion.<br />&#8203;</strong><br /><strong><font color="#3387a2">Why the First Response Matters More Than Companies Realize</font></strong><br /><br /><strong>When Oracle contacts an organization about Java, it typically requests information such as:</strong><ul><li><strong>Where Java is installed</strong></li><li><strong>How many users or systems run Java</strong></li><li><strong>Whether Java is used in production, development, or testing</strong></li></ul> <strong> Companies often respond with estimates, partial inventories, or assumptions. That information&mdash;once provided&mdash;frequently becomes the basis for Oracle&rsquo;s compliance position and monetary claims.<br /><br />The problem is not simply whether the information is accurate. It is that:</strong><ul><li><strong>Java is often deployed incidentally, not intentionally</strong></li><li><strong>Many organizations lack a centralized Java inventory</strong></li><li><strong>Different Java distributions and versions have different licensing implications</strong></li><li><strong>Some software comes with an embedded Java licenses, so there is no compliance issue</strong></li></ul> <strong> What starts as an attempt to be cooperative can quickly create a record that Oracle later relies on to justify a multi-million dollar licensing demand.</strong><br /><br /><strong><font color="#3387a2">Why Java Compliance Exposure Escalates So Quickly</font></strong><br /><br /><strong><font color="#3387a2">A. Java Is Embedded Throughout Enterprise IT Environments</font></strong><br /><br /><strong>Java appears in far more places than most companies expect, including:</strong><ul><li><strong>Legacy enterprise applications</strong></li><li><strong>Third-party commercial software</strong></li><li><strong>Developer workstations</strong></li><li><strong>Build servers</strong></li><li><strong>Virtual desktop environments</strong></li><li><strong>Cloud images and containers</strong></li></ul> <strong> Because Java is frequently bundled with other software or installed automatically, organizations often underestimate how widely it is deployed.</strong><br /><br /><strong><font color="#3387a2">B. Oracle&rsquo;s Java Subscription Model Multiplies Cost</font></strong><br /><br />&#8203;<strong>Oracle&rsquo;s current Java licensing framework is subscription-based. In recent years, Oracle has emphasized pricing models that can be tied to total employee headcount rather than actual Java installations.<br /><br />For many organizations, this creates a severe mismatch between usage and cost:</strong><ul><li><strong>A limited number of Java deployments can trigger enterprise-wide subscription requirements</strong></li><li><strong>Employee-based pricing dramatically increases exposure for mid-sized and large companies</strong></li><li><strong>The cost to &ldquo;resolve&rdquo; an audit may bear little relationship to the business value derived from Java</strong></li></ul> <strong> This is why Java compliance claims routinely reach millions of dollars, even when Java is not mission-critical.</strong><br /><br /><strong><font color="#3387a2">C. Ongoing Confusion About &ldquo;Free Java&rdquo;</font></strong><br /><br /><strong>Despite years of changes to Java licensing, confusion remains widespread. Many companies assume:</strong><ul><li><strong>Java is open source</strong></li><li><strong>All OpenJDK distributions are interchangeable</strong></li><li><strong>Upgrading eliminates licensing risk</strong></li></ul> <strong> In reality, Java licensing depends on:</strong><ul><li><strong>The specific distribution (Oracle JDK vs. OpenJDK vs. third-party builds)</strong></li><li><strong>The version and update history</strong></li><li><strong>The applicable license terms at the time of use</strong></li></ul> <strong> Mistaken assumptions about &ldquo;free Java&rdquo; are one of the most common drivers of compliance disputes.</strong><br /><br /><strong><font color="#3387a2">Oracle&rsquo;s Leverage Strategy in Java Licensing Disputes</font></strong><br /><br />I<strong>I</strong><strong>n practice, Oracle&rsquo;s Java enforcement approach often follows a consistent pattern:</strong><ol><li><strong>Identify potential Java usage&nbsp;through download activity or other signals</strong></li><li><strong>Initiate friendly outreach&nbsp;that does not resemble a traditional audit</strong></li><li><strong>Request self-reported deployment information</strong></li><li><strong>Highlight gaps, uncertainty, or risk&nbsp;in the company&rsquo;s responses</strong></li><li><strong>Present subscription purchases&nbsp;as the fastest and safest way to resolve the issue</strong></li></ol> <strong> The pressure to &ldquo;fix the problem&rdquo; quickly&mdash;combined with licensing complexity&mdash;often leads companies to agree to broad Java subscriptions without fully evaluating alternatives.<br /><br /><font color="#3387a2">What Companies Are Doing in Response</font><br /><br />As Java enforcement has intensified, organizations are increasingly reassessing their Java strategies. Common responses in the marketplace include:</strong><ul><li><strong>Standardizing on non-Oracle Java distributions where feasible</strong></li><li><strong>Actively removing Oracle JDK from environments where it is not required</strong></li><li><strong>Tightening controls over Java downloads and installations</strong></li><li><strong>Centralizing Java inventory and license governance</strong></li></ul> <strong> Even companies that ultimately continue using Oracle-licensed Java are approaching negotiations more deliberately, with a clearer understanding of their actual needs and risk profile.</strong><br /><br /><strong><font color="#3387a2">Practical Steps to Reduce Java Audit and Licensing Risk<br /></font></strong><br /><font color="#3387a2"><strong>&nbsp; &nbsp; &nbsp;Before Oracle Contacts You</strong></font><br /><br /><strong>Proactive planning significantly reduces exposure.</strong><ul><li><strong>Establish a clear policy identifying approved Java distributions</strong></li><li><strong>Limit downloads from Oracle-controlled Java sources unless intentionally licensed</strong></li><li><strong>Inventory Java across servers, desktops, virtual environments, and cloud workloads</strong></li><li><strong>Remove legacy or unused Java installations</strong></li><li><strong>Educate IT and development teams on Java licensing boundaries</strong></li></ul> <strong><font color="#3387a2">&nbsp; &nbsp; &nbsp; &nbsp;<br />&nbsp;&nbsp; &nbsp; &nbsp; If Oracle Has Already Reached Out</font></strong><br /><br /><strong>The first response often determines the trajectory of the engagement.</strong><ul><li><strong>Treat the outreach as a legal and commercial matter, not a technical request</strong></li><li><strong>Do not provide deployment data before completing an internal review</strong></li><li><strong>Designate a single point of contact</strong></li><li><strong>Ask Oracle to clarify the scope and basis of its inquiry in writing</strong></li><li><strong>Retain experience outside counsel who have dealt with Oracle before in disputes involving Java licensing</strong></li></ul> <strong> Early discipline can prevent an informal conversation from becoming an expensive compliance dispute.</strong><br /><br /><strong><font color="#3387a2">Conclusion</font></strong><br /><strong><br />Oracle&rsquo;s Java licensing enforcement is no longer passive or occasional. It is systematic, data-driven, and increasingly detached from traditional audit formalities. Organizations that assume Java is low risk&mdash;or that a friendly email requires a friendly response&mdash;are often caught unprepared.<br /><br />Companies that take proactive steps to understand their Java footprint, control deployments, and manage communications are far better positioned to avoid coercive licensing outcomes and unnecessary enterprise-wide subscriptions. However, if your company has already been contacted by Oracle or has shared Java related data with Oracle, then it is time to retain experienced outside counsel to assist the company in resolving the dispute.&nbsp;&nbsp;<br /><br />&#8203;Tactical Law has assisted multiple clients to resolve Java licensing disputes with Oracle.</strong><br /><br /></div>]]></content:encoded></item><item><title><![CDATA[Brown v. GlobalLogic and Oracle: Key Allegations, Oracle E‑Business Suite, and What It Means for Customers]]></title><link><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/brown-v-globallogic-and-oracle-key-allegations-oracle-e-business-suite-and-what-it-means-for-customers]]></link><comments><![CDATA[https://www.tacticallawgroup.com/oracle-software-audit-blog/brown-v-globallogic-and-oracle-key-allegations-oracle-e-business-suite-and-what-it-means-for-customers#comments]]></comments><pubDate>Thu, 13 Nov 2025 11:51:24 GMT</pubDate><category><![CDATA[Uncategorized]]></category><guid isPermaLink="false">https://www.tacticallawgroup.com/oracle-software-audit-blog/brown-v-globallogic-and-oracle-key-allegations-oracle-e-business-suite-and-what-it-means-for-customers</guid><description><![CDATA[By Pam FulmerA new class action filed in the Western District of Texas alleges that GlobalLogic Inc. and Oracle Corporation failed to protect highly sensitive personal information associated with GlobalLogic&rsquo;s workforce. The complaint, brought by a former GlobalLogic employee, ties the incident to a zero&#8209;day vulnerability that affected Oracle E&#8209;Business Suite (EBS), and it raises significant questions for organizations that run HR, payroll, and finance on Oracle&rsquo;s flagshi [...] ]]></description><content:encoded><![CDATA[<div class="paragraph"><strong><font size="4">By Pam Fulmer</font><br /><br />A new class action filed in the Western District of Texas alleges that GlobalLogic Inc. and Oracle Corporation failed to protect highly sensitive personal information associated with GlobalLogic&rsquo;s workforce. The complaint, brought by a former GlobalLogic employee, ties the incident to a zero&#8209;day vulnerability that affected Oracle E&#8209;Business Suite (EBS), and it raises significant questions for organizations that run HR, payroll, and finance on Oracle&rsquo;s flagship ERP platform. A "zero day" (also written as "0-day") refers to a previously unknown software vulnerability that is discovered and exploited by attackers before the software vendor becomes aware of it and has a chance to develop and release a fix or patch. The term "zero day" comes from the fact that the vendor has had zero days to address and remediate the vulnerability. Below is a concise overview of the allegations, the Oracle software at issue, the timeline, and potential implications for Oracle and its customers.<br /><br /><font color="#3387a2">Who the parties are and where the case was filed</font><br /></strong><ul><li><strong>Plaintiff: Arianna M. Brown, a New York citizen and former GlobalLogic employee, sues on behalf of a proposed nationwide class of individuals whose PII was compromised.&nbsp;(p. 3)</strong></li><li><strong>Defendants: GlobalLogic Inc. (Delaware; principal place of business Santa Clara, CA) and Oracle Corporation (Delaware; principal place of business Austin, TX).&nbsp;(p. 3)</strong></li><li><strong>Jurisdiction/venue: CAFA jurisdiction is alleged; venue is the Austin Division of the Western District of Texas based on Oracle&rsquo;s principal place of business.&nbsp;(p. 3)</strong></li></ul><strong><br /><font color="#3387a2">What Oracle software is involved?</font><br /><br />The complaint squarely focuses on Oracle E&#8209;Business Suite. GlobalLogic allegedly &ldquo;uses Oracle E-Business Suite, a collection of applications, to manage core business functions such as finance, HR, accounts payable and receivable.&rdquo;&nbsp;(p. 2)&nbsp;The plaintiff alleges Oracle issued a security advisory on October 4, 2025 concerning a previously unknown zero&#8209;day exploit, that GlobalLogic determined its Oracle instance was exploited, and that the exfiltrated data came from the Oracle platform hosting HR information.&nbsp;(p. 7)<br />Based on GlobalLogic&rsquo;s description, the exposed HR data could include names, contact details, dates of birth, nationality and passport information, employee identifiers, SSNs or other national identifiers, salary data, and bank account and routing numbers.&nbsp;(p. 8)&nbsp;For EBS customers, this underscores the sensitivity of the data commonly centralized in HR/payroll modules.<br /><br /><font color="#3387a2">The alleged timeline</font><br /></strong><ul><li><strong>Earliest threat actor activity: July 10, 2025.&nbsp;(p. 7)</strong></li><li><strong>Most recent activity: August 20, 2025.&nbsp;(p. 7)</strong></li><li><strong>Oracle advisory: October 4, 2025 (previously unknown zero&#8209;day).&nbsp;(p. 7)</strong></li><li><strong>Exfiltration identified: October 9, 2025.&nbsp;(p. 7)</strong></li><li><strong>Notification: Began November 7, 2025; at least 10,471 individuals impacted according to a filing with the Maine Attorney General.&nbsp;(p. 8&nbsp;,&nbsp;p. 8)</strong></li></ul><strong>GlobalLogic states it activated incident response, engaged third&#8209;party cybersecurity experts, notified law enforcement, and applied Oracle&rsquo;s patches upon release.&nbsp;(p. 7)&nbsp;The plaintiff alleges that notification lagged roughly 120 days after initial malicious activity.&nbsp;(p. 8)<br /><br /><font color="#3387a2">Alleged harms and risks</font><br /><br />The plaintiff claims actual misuse (a ~$520 fraudulent debit card charge in or around September 2025), increased spam/scam outreach, and ongoing time and anxiety related to monitoring.&nbsp;(p. 11)&nbsp;The complaint emphasizes continuing risks of identity theft given the breadth of HR data allegedly accessed and notes that the breach notice advised vigilance, fraud alerts, and potential contact with the FTC and law enforcement.&nbsp;(p. 9)<br /><br /><font color="#3387a2">Theories of liability</font><br /><br />The complaint pleads six causes of action:<br /></strong><ul><li><strong>Negligence: Alleged failure to implement and maintain reasonable security, to detect unauthorized access, to timely notify, and to adhere to industry standards; foreseeability of harm from compromised PII.&nbsp;(p. 22)</strong></li><li><strong>Negligence per se: Alleged violations grounded in Section 5 of the FTC Act and related FTC guidance regarding reasonable data security.&nbsp;(p. 25)</strong></li><li><strong>Breach of Implied Contract: PII provided as a condition of employment, with implied promises (and policy representations) to safeguard and promptly notify; alleged material breach by failing to safeguard and to notify.&nbsp;(p. 27)</strong></li><li><strong>Invasion of Privacy: Highly offensive unauthorized acquisition and disclosure of highly sensitive PII; alleged knowing inadequacy of security and notification delays.&nbsp;(p. 30)</strong></li><li><strong>Unjust Enrichment (pled in the alternative): Defendants allegedly benefited from employees&rsquo; PII and saved costs by underinvesting in security, unjustly retaining the benefit.&nbsp;(p. 32)</strong></li><li><strong>Breach of Fiduciary Duty: Alleged fiduciary obligations to safeguard PII, timely notify, and maintain accurate records; alleged breach through insufficient protection and delay.&nbsp;(p. 33)</strong></li></ul><strong><br />Requested relief includes class certification, damages (including punitive where available), restitution/disgorgement, injunctive and declaratory relief, fees, and interest.&nbsp;(p. 34)<br /><br /><font color="#3387a2">What this could mean for Oracle</font><br /></strong><ul><li><strong>Litigation exposure alongside customers: By naming Oracle, the lawsuit highlights a trend where platform vendors may be sued together with customers when a vulnerability is implicated. The complaint asserts that many Oracle customers may have been impacted and that GlobalLogic&rsquo;s Oracle instance was exploited.&nbsp;(p. 8)</strong></li><li><strong>Spotlight on secure development and advisories: Oracle&rsquo;s advisory on October 4, 2025 regarding a previously unknown zero&#8209;day will likely focus discovery on secure development lifecycle, vulnerability disclosure, and emergency patching cadence.&nbsp;(p. 7)</strong></li><li><strong>Shared responsibility debates: Expect arguments about the division of responsibilities between Oracle (code/vendor advisories and patches) and customers (configuration, identity and access management, monitoring, segmentation). The complaint advances broad duty allegations against both companies.&nbsp;(p. 20)</strong></li><li><strong>Contract and representations scrutiny: While the complaint quotes GlobalLogic&rsquo;s privacy policy and recruitment notice to establish data protection representations, plaintiffs may also explore any Oracle contractual terms or security documentation for representations and reliance.&nbsp;(p. 6)</strong></li></ul><strong><br /><font color="#3387a2">Implications and practical steps for Oracle EBS customers</font><br /><br />Given the alleged vector and data at issue, organizations running EBS for HR and finance should consider the following steps:<br /></strong><ul><li><strong>Map and minimize HR data in EBS: Identify exactly which PII elements reside in EBS HR modules and assess encryption at rest/in transit, tokenization options (e.g., SSNs, bank details), data minimization, and retention. The complaint&rsquo;s description of impacted fields illustrates the breadth of sensitive data often centralized in EBS.&nbsp;(p. 8)</strong></li><li><strong>Accelerate zero&#8209;day response: Establish a rapid pipeline for processing Oracle critical advisories&mdash;triage, exploitability assessment, emergency change windows&mdash;and deploy compensating controls (WAF rules, segmentation) while patching. The timeline suggests adversary activity predating public advisories, reinforcing the need for layered defenses.&nbsp;(p. 7)</strong></li><li><strong>Monitor for exfiltration from EBS: Tune database activity monitoring, DLP, and egress controls to EBS data flows, with alerts for bulk exports or anomalous queries and sufficient logging for forensics. The complaint alleges exfiltration on a particular date, making rapid detection and containment crucial.&nbsp;(p. 7)</strong></li><li><strong>Rehearse breach notification workflows: Coordinate legal, HR, and IT to satisfy multi&#8209;state notification requirements and avoid delays that can exacerbate harm and litigation risk. The complaint flags a roughly 120&#8209;day gap before notices began.&nbsp;(p. 8)</strong></li><li><strong>Revisit vendor contracts and SLAs: Clarify roles and expectations for vulnerability disclosure, patch SLAs, hardening guidance, telemetry, and incident coordination among Oracle, managed service providers, and your team.&nbsp;(p. 7)</strong></li></ul><strong><br /><font color="#3387a2">What to watch procedurally</font><br /><br />Defendants will likely contest class certification and move to dismiss certain claims, particularly around the existence and scope of duties, causation, and damages, and whether Oracle, as a platform vendor, owed duties directly to GlobalLogic&rsquo;s employees. Expect factual disputes over controls in place, detection/notification timelines, and the extent of any misuse. The court&rsquo;s treatment of duty and causation in a shared&#8209;responsibility context will be closely watched by Oracle customers and other ERP platform users.<br /><br /><font color="#3387a2">Bottom line</font><br /><br />Brown v. GlobalLogic and Oracle places Oracle E&#8209;Business Suite at the center of a high&#8209;stakes data breach class action and highlights the operational and legal risks when zero&#8209;days intersect with platforms that centralize highly sensitive employee data. Regardless of outcome, the allegations provide a timely reminder to EBS customers to tighten zero&#8209;day preparedness, harden identity and access, monitor for exfiltration, streamline notification workflows, and clarify vendor/customer responsibilities.</strong><br /></div>]]></content:encoded></item></channel></rss>