TomorrowNow allegedly pretending to be Oracle customers and illegally hacking into its secure support Web site for users of Oracle's PeopleSoft and JD Edwards applications. SAP then allegedly copied content from the site and used it to offer Oracle customers cut-rate support services in the hopes of eventually migrating them over to SAP's rival applications.

So far, SAP has yet to respond publicly to the accusations, perhaps suggesting that a countersuit could be in the offing. As for Oracle, the vendor hasn't made any additional comment beyond the lawsuit itself.

"If we decide to trust a company, we'd hope it to be justified," said an IT manager at a French company that uses JD Edwards applications and sources its support for that software from TomorrowNow. "When we choose a supplier, we don't necessarily investigate them first," he added. The manager agreed to speak on the condition of anonymity for himself and his company.

While products, services and price are primary factors in procurement decisions, a vendor's ethics and business practices are also extremely important, according to John Matelski, chief security officer and deputy chief information officer for the city of Orlando and a JD Edwards user. He's also the former president of the Quest International Users Group, which focuses on the needs of PeopleSoft and JD Edwards applications customers that Oracle acquired through the January 2005 purchase of PeopleSoft.

"As a public-sector entity, which is directly accountable to its citizens and constituents, I would be concerned about our relationship with any vendor that is proven to conduct business in an unethical manner," Matelski wrote in an e-mail response for comment. He would prefer to do business with companies that can be trusted, and do not have a track record of inappropriate business practices.

"Due to the nature of the relationships that we develop, software vendors and consultants would be held to a higher standard, because they would typically have a greater level of access to our systems and data during implementation and support engagements," Matelski wrote. "The security and privacy of our data is key, and if an organization is known to have illegally obtained data before, I would need to be much more careful when evaluating whether to establish or continue a relationship with them."

David Mitchell, software practice leader at analyst Ovum drew a comparison between the potential damage of the lawsuit with fallout of the corporate spy scandal that hit Hewlett-Packard Co. last year. Despite leading to the resignations of several executives including its chairman, HP weathered the storm well and customers stayed loyal to the company.

"With HP, Hurd responded positively, he apologized," Mitchell said. "It was about the approach they took when something inappropriate had happened. If HP had not responded so positively I think they would have seen more negative consequences."

Should Oracle's charges against SAP be proven, "they need to embrace it and reassure people how it's come about," he added. If there was some wrongdoing, Mitchell, the former senior director for market development at Oracle UK, believes it'll turn out to be the work of one bad apple. "SAP ethically and culturally is a very correct organization, this isn't rotten DNA," he said. "If this turns out to be true, then it will be an individual, I think, who has acted inappropriately."

As for Oracle, the vendor needs to act to avoid any negative publicity from the suit given that it named many customers whose identities were allegedly purloined by SAP and suggested that SAP customers unknowingly might be using services that contain Oracle's intellectual property. "It could be good for Oracle to say, 'We have no beef with the customer, our beef is with SAP,'" Mitchell said. "Or it could be perceived as Oracle picking on the customer."

Andreas Chatziantoniou, a software consultant specializing in Oracle products with Accenture Technology Services in the Netherlands, wondered about another potential negative hit on Oracle.

"From the reputation side, I believe that this can backfire," he wrote in an e-mail. "Oracle has a reputation for dumpster diving in order to get information about competitors," alluding to an incident in 2000 when Oracle defended the actions of detectives it hired to investigate two research groups that supported Microsoft Corp. during its antitrust trial.

The lawsuit might be Oracle's way to gain some extra publicity, following the release earlier this week of the vendor's third-quarter financial results, according to Chatziantoniou. Perhaps a case of "read between the lines: our results could have been much better when SAP would play by the rules," he suggested.

The lawsuit alone won't deter customers from buying SAP's applications, but the noise around the legal action might give both SAP and Oracle users the sense that the firms are distracted and not fully focused on customers' needs, he added.

Now isn't the time for either Oracle or SAP to lose focus, given the competitive threat they face.

Last week, Microsoft, which has tended to focus more on the small to midsize business market with its Dynamics applications, vowed to compete more aggressively in the enterprise market against Oracle and SAP.

Another issue that should give vendors pause is that customers have long memories when it comes to scandals, Chatziantoniou wrote. "Even years later, people (the decision makers) remember the 'bad publicity,'" he added. What might suit the vendors' customers and partners is an out-of-court settlement, he concluded.

"So far such a situation has never happened to me in my business life, but if it did I would consider the fact very heavily when doing business with such a company," Manfred Reif, a managing director at HSH Nordbank, a credit investment bank in Luxembourg, wrote in an e-mail response to comment on the lawsuit. "Nevertheless, first of all being suspicious and 'listening' to your gut feeling should be one's daily duty," he added.

Another factor to bear in mind is the number of customers Oracle and SAP share, Seth Ravin, CEO and president of Rimini Street ., pointed out. He's a co-founder of TomorrowNow, selling his share of the company to SAP in early 2005 and establishing Rimini Street as a rival supplier of third-party maintenance and support.

While Oracle and SAP compete bitterly in the applications market, plenty of SAP users run their software on Oracle's database and middleware. It's in both vendors' interest to resolve the current dispute rapidly.

"So far, we've only heard one side of the argument," Ravin said, with SAP yet to comment.

Given how closely Oracle and SAP watch each other, he finds it hard to believe that the alleged actions by TomorrowNow were deliberate. "I strongly doubt it," he said, adding that such behavior wouldn't be in anyone's best interests and would likely be quickly discovered. Oracle appears to require users of its customer support database to be "self-policing," he said, in other words, they have access to more content than their specific needs warrant, which may have led to some confusion about what was OK for SAP to access and what wasn't.