Loading story…
Clop, a Russian-speaking cybercriminal group, has launched a widespread campaign exploiting a critical vulnerability in Oracle E-Business Suite (EBS), targeting hundreds of organizations globally. Allianz UK confirmed that it was among the victims, with the attackers compromising data belonging to 80 current and 670 former customers, though no impact was reported for its subsidiary Liverpool Victoria (LV). The attack vector was traced to Oracle EBS used in Allianz UK's personal lines business, and the company reported the incident to the Information Commissioner's Office. Other notable victims include the Washington Post and Envoy Air, with researchers estimating that dozens of organizations may have been affected since July, exploiting CVE-2025-61882.
Clop's campaign is characterized by data exfiltration and extortion rather than traditional ransomware, with the group threatening to leak stolen data unless contacted by victims within a set deadline. Logitech was also named as a target, though the company has not confirmed a breach. The campaign's scale is significant, with at least 835 documented victims attributed to Clop since 2019, and the group has previously exploited vulnerabilities in other file-transfer platforms such as MOVEit and Fortra GoAnywhere. The Oracle EBS vulnerability was first detected in July, with Oracle releasing an initial patch in October that proved insufficient, necessitating a second critical update and leaving many organizations exposed for several days.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
Logitech confirmed a data breach attributed to exploitation of a zero-day in a third-party platform reportedly involving Oracle E-Business Suite. The company said limited employee, consumer, customer, and supplier data was likely exfiltrated, but not highly sensitive data such as national ID or credit card numbers.
Reporting on November 13-14 indicated that The Washington Post was among the organizations impacted in Clop's Oracle EBS campaign, with nearly 10,000 people affected. The disclosure added another major victim to the growing list tied to CVE-2025-61882.
GlobalLogic disclosed that a breach tied to the Oracle EBS zero-day exposed sensitive HR data for nearly 10,500 current and former employees. The company acknowledged the theft as part of the wider Clop campaign targeting Oracle customers.
Allianz UK confirmed it was impacted by Clop's exploitation of Oracle E-Business Suite after claims involving Liverpool Victoria. The insurer said only Allianz UK customer data was affected, impacting 80 current and 670 former customers, and reported the matter to the UK ICO.
Oracle released a security patch for the Oracle E-Business Suite zero-day CVE-2025-61882 after months of exploitation. Affected organizations later reported applying the fix as part of their response.
GlobalLogic detected the breach in October 2025 and began notifying authorities, engaging third-party investigators, and applying Oracle's patches. The company later linked the incident to Clop's wider Oracle customer attack spree.
GlobalLogic said attackers accessed and stole sensitive HR data belonging to more than 10,000 current and former employees during a compromise window running from July 10 to August 20, 2025. Exposed data included personal identifiers, contact details, and financial information.
A broader Clop extortion campaign targeting Oracle E-Business Suite began as early as July 2025, according to reporting and Google researchers. The activity was tied to CVE-2025-61882 and is believed to have affected dozens of organizations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
12 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourcescworld.com
Open sourcego.theregister.com
Open sourcebleepingcomputer.com
Open sourcescworld.com
Open sourcego.theregister.com
Open sourcezendata.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A widespread extortion campaign has targeted executives at multiple organizations using Oracle's E-Business Suite, with attackers claiming to have stolen sensitive data from these systems. The campaign, which began on or before September 29, 2025, involves a high volume of emails sent from hundreds of compromised third-party accounts. These emails demand extortion payments and provide contact information that matches addresses listed on the Clop ransomware group's data leak site, suggesting a possible connection to the notorious threat actor. Security researchers from Mandiant and Google Threat Intelligence Group (GTIG) are actively investigating the claims, but as of now, there is no independent verification that any data has actually been stolen from Oracle E-Business Suite environments. The emails are highly targeted, reaching company executives and leveraging previously compromised email accounts, some of which have been associated with FIN11, another financially motivated threat group known for ransomware and extortion activities. The tactics used in this campaign closely resemble those previously employed by Clop, including the use of compromised accounts and public leak site contact details, but the group has not publicly claimed responsibility on its leak sites. Oracle has not responded to requests for comment, and there is no confirmation of any zero-day vulnerabilities being exploited in Oracle E-Business Suite as part of this campaign. Researchers emphasize that the credibility of the attackers' claims remains unproven, and organizations are urged to investigate their Oracle environments for signs of compromise or unusual access. The campaign's scale and sophistication highlight the ongoing threat posed by ransomware and extortion groups targeting enterprise software platforms. The incident has raised concerns among Oracle customers, many of whom are now conducting internal investigations to assess potential exposure. The use of hundreds of compromised accounts to distribute the extortion emails demonstrates the attackers' ability to orchestrate large-scale, coordinated campaigns. The incident also underscores the importance of monitoring for suspicious activity in critical business applications and maintaining robust incident response procedures. While the Clop group has a history of exploiting file-transfer services for mass data theft, such as the MOVEit breach in 2023, it remains unclear whether this Oracle campaign represents a similar level of compromise. Security experts continue to monitor the situation and advise vigilance among organizations using Oracle E-Business Suite. The lack of public confirmation from Clop and Oracle leaves many questions unanswered, but the campaign serves as a reminder of the persistent threat landscape facing enterprise IT environments. Organizations are encouraged to report any related incidents to law enforcement and share threat intelligence with trusted partners to help contain the potential impact.
Jun 29, 2026
Clop ransomware group exploited a zero-day vulnerability in Oracle E-Business Suite (EBS), tracked as CVE-2025-61882, to compromise major organizations including Schneider Electric, Emerson, Harvard University, and others. The vulnerability allowed unauthenticated remote access to Oracle Concurrent Processing, enabling attackers to exfiltrate large volumes of sensitive data such as ERP records, financial documents, procurement workflows, and engineering files. Clop reportedly maintained access for months, exfiltrating 2.7 terabytes from Emerson and 116 gigabytes from Schneider Electric, with the breach going undetected by traditional monitoring tools. Security experts warn that the impact extends beyond data theft, as attackers may leverage stolen information for extortion, supply chain exploitation, and credential harvesting. Oracle has released patches for CVE-2025-61882 and strongly urges all EBS customers to apply updates immediately. The campaign highlights the risks posed by trusted vendor dependencies and the potential for widespread disruption across critical infrastructure and operational technology supply chains. Attribution remains under investigation, with both Clop and the financially motivated FIN11 group suspected of involvement.
Jun 29, 2026
The Clop ransomware group exploited a zero-day vulnerability in Oracle E-Business Suite to gain unauthorized access to the Washington Post's internal systems, resulting in the theft of sensitive personal and financial data belonging to nearly 10,000 current and former employees and contractors. The attackers accessed the environment between July 10 and August 22, 2025, and subsequently attempted to extort the company in late September after contacting the Post to claim responsibility for the breach. The compromised data included names, bank account numbers, routing numbers, and Social Security numbers, and the breach was confirmed after an internal investigation prompted by the extortion attempt. The Washington Post is one of several major organizations targeted in this campaign, with other confirmed victims including Envoy Air and GlobalLogic. Oracle has since disclosed the vulnerability, now tracked as CVE-2025-61882 and CVE-2025-61884, and released patches to address the issue. The incident highlights the risks posed by zero-day vulnerabilities in widely used enterprise software and the increasing trend of ransomware groups leveraging such flaws for data theft and extortion campaigns against high-profile targets.
Jun 29, 2026