Apparently, the attacker had logged into Oracle's support portal on behalf of a victimized Oracle customer and asked a visibly overwhelmed employee for information on how to proceed. Callback number?