Oracle has confirmed that a group of hackers stole data from its E-Business Suite (EBS) applications and is using the information in extortion campaigns.
The company warns that these attackers exploited vulnerabilities already fixed in the July 2025 Critical Patch Update (CPU).
Oracle strongly urges all customers to apply the latest CPU immediately to defend against further intrusions.
Executives and IT teams at several large organizations have received extortion emails claiming their Oracle EBS data was copied.
The hackers demand ransoms of up to $50 million to prevent public release. Cybersecurity firm Halcyon, which is responding to incidents, says the group identifies itself as linked to the Cl0p ransomware gang.
Victims have received screenshots, file lists, and proofs of stolen records to back up the threats.
The attackers began sending email threats on or before September 29, using hundreds of compromised third-party accounts.
The notes featured poor English and grammar, a hallmark of Cl0p communications. At least one firm has publicly acknowledged that its EBS data was exfiltrated.
According to Genevieve Stark of Google Threat Intelligence Group, one of the addresses used in the extortion notes was previously tied to a Cl0p affiliate.
Halcyon’s Cynthia Kaiser explains that Cl0p is known for stealthy mass data theft and high ransom demands. In past high-profile incidents, the group exploited flaws in MOVEit file-transfer software to steal data from hundreds of organizations.
Cl0p has targeted major companies such as Shell, British Airways, and the BBC, demanding large payouts to avoid data leaks.
Attackers reportedly abused default password-reset functions on internet-facing EBS portals. However, some insiders believe the breach stemmed from an EBS vulnerability addressed in July’s CPU.
Oracle’s investigation is ongoing, and the company has not yet commented on the exact method of intrusion.
All Oracle EBS customers should verify that the July 2025 CPU has been applied to every instance. Organizations still using older patch levels face increased risk of data theft and extortion.
Security teams should review access logs for suspicious password-reset activity and monitor third-party accounts for signs of compromise.
In addition, customers should implement strong multi-factor authentication for EBS access and restrict administrative functions to trusted networks.
Regularly verify system integrity with automated scans and maintain offline backups to ensure rapid recovery.
Oracle continues collaborating with law enforcement and cybersecurity partners to track the campaign and support affected customers.
Applying the July 2025 CPU remains the critical first step in safeguarding E-Business Suite environments against these extortion threats.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…