Loading story…
Logitech, a major manufacturer of computer peripherals, disclosed a data breach after attackers exploited a zero-day vulnerability in a third-party software platform, reportedly Oracle E-Business Suite. The breach, claimed by the Clop ransomware group, resulted in the unauthorized copying of approximately 1.8 terabytes of data from one of Logitech’s internal IT systems. The compromised data included limited information about employees, consumers, customers, and suppliers, but did not contain sensitive personal information such as national ID numbers or credit card details. Logitech stated that the incident did not impact its products, business operations, or manufacturing, and that any financial impact would be covered by cyber insurance.
Security experts highlighted that this attack underscores the growing risk posed by supply chain vulnerabilities, as threat actors increasingly target vendors and back-end systems to gain access to broader ecosystems. The Clop group reportedly used a variety of vulnerabilities in Oracle E-Business Suite, including at least one zero-day, to facilitate the breach. The incident serves as a reminder for organizations to strengthen third-party risk management, implement least-privilege access, and maintain continuous monitoring to mitigate the impact of similar attacks in the future.
See attribution, scope, and your downstream exposure.
8 events from the most recent confirmed update back to the earliest known activity.
A later report characterized the Logitech incident as exposing 1.8TB of data, adding a more specific estimate of the volume of information affected. This appears to be a subsequent detail about the same Clop-linked breach.
In its disclosure, Logitech said it did not expect a material financial impact from the breach because related costs would be covered by cyber insurance. This provided the company's initial assessment of the business consequences.
Logitech disclosed to the SEC that hackers had copied certain data from its internal IT systems in the Clop-linked intrusion. The company said the incident did not affect products, business operations, or manufacturing, and that no highly sensitive personal data such as national ID numbers or credit card information was involved.
The FBI and security researchers warned that the vulnerabilities used in the campaign were critical and called on organizations to patch immediately. Their statements underscored the ongoing risk from the exploited software flaws.
Envoy Air and Harvard University also confirmed data theft tied to the same Clop campaign, showing the exploitation affected multiple organizations beyond Logitech. These confirmations helped establish the broader scope of the incident cluster.
Clop publicly claimed responsibility for the Logitech intrusion as part of a broader campaign that also affected numerous other organizations. The group used its leak site to name victims and pressure them for extortion.
The Clop ransomware group exploited a zero-day vulnerability in a third-party software platform, reportedly Oracle's E-Business Suite, to access Logitech's internal IT systems and copy data. The stolen information included limited data on employees, consumers, customers, and suppliers.
Oracle said the vulnerabilities exploited in the campaign had been fixed in a previous update, indicating patches were available before the later victim disclosures. The flaws were reportedly in Oracle's E-Business Suite and were abused as zero-days against organizations that had not remediated them.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
securityboulevard.com
Open sourcethecyberthrone.in
Open sourcescworld.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Clop, a Russian-speaking cybercriminal group, has launched a widespread campaign exploiting a critical vulnerability in Oracle E-Business Suite (EBS), targeting hundreds of organizations globally. Allianz UK confirmed that it was among the victims, with the attackers compromising data belonging to 80 current and 670 former customers, though no impact was reported for its subsidiary Liverpool Victoria (LV). The attack vector was traced to Oracle EBS used in Allianz UK's personal lines business, and the company reported the incident to the Information Commissioner's Office. Other notable victims include the Washington Post and Envoy Air, with researchers estimating that dozens of organizations may have been affected since July, exploiting CVE-2025-61882. Clop's campaign is characterized by data exfiltration and extortion rather than traditional ransomware, with the group threatening to leak stolen data unless contacted by victims within a set deadline. Logitech was also named as a target, though the company has not confirmed a breach. The campaign's scale is significant, with at least 835 documented victims attributed to Clop since 2019, and the group has previously exploited vulnerabilities in other file-transfer platforms such as MOVEit and Fortra GoAnywhere. The Oracle EBS vulnerability was first detected in July, with Oracle releasing an initial patch in October that proved insufficient, necessitating a second critical update and leaving many organizations exposed for several days.
Jun 29, 2026
Clop ransomware group exploited a zero-day vulnerability in Oracle E-Business Suite (EBS), tracked as CVE-2025-61882, to compromise major organizations including Schneider Electric, Emerson, Harvard University, and others. The vulnerability allowed unauthenticated remote access to Oracle Concurrent Processing, enabling attackers to exfiltrate large volumes of sensitive data such as ERP records, financial documents, procurement workflows, and engineering files. Clop reportedly maintained access for months, exfiltrating 2.7 terabytes from Emerson and 116 gigabytes from Schneider Electric, with the breach going undetected by traditional monitoring tools. Security experts warn that the impact extends beyond data theft, as attackers may leverage stolen information for extortion, supply chain exploitation, and credential harvesting. Oracle has released patches for CVE-2025-61882 and strongly urges all EBS customers to apply updates immediately. The campaign highlights the risks posed by trusted vendor dependencies and the potential for widespread disruption across critical infrastructure and operational technology supply chains. Attribution remains under investigation, with both Clop and the financially motivated FIN11 group suspected of involvement.
Jun 29, 2026
Oracle disclosed a critical zero-day vulnerability, CVE-2025-61882, in its E-Business Suite that was actively exploited by the Clop ransomware group to conduct a widespread data theft and extortion campaign. The vulnerability, which affects Oracle E-Business Suite, was addressed in a security advisory released on a Saturday, with Oracle urging customers to apply the patch immediately to mitigate the risk of compromise. Federal cyber authorities and threat intelligence researchers expressed heightened concern following Oracle’s announcement, as the flaw had been exploited for at least eight weeks before some victims received extortion demands. The Clop group leveraged this zero-day, along with other vulnerabilities previously addressed in Oracle’s July security update, to gain unauthorized access to enterprise resource planning (ERP) systems. Once inside, the attackers exfiltrated sensitive data and subsequently targeted executives with spear-phishing emails containing ransom demands, threatening to leak or misuse the stolen information. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-61882 to its known exploited vulnerabilities catalog, confirming its use in active ransomware campaigns. Oracle’s Chief Security Officer, Rob Duhart, updated customers via a blog post, providing indicators of compromise and emphasizing the urgency of patching. The FBI’s Cyber Division described the situation as an emergency, highlighting the critical role Oracle E-Business Suite plays in both public and private sector organizations and the high incentive for attackers to weaponize the vulnerability quickly. Security briefings noted that organizations running Oracle E-Business Suite were specifically targeted, with attackers using sophisticated spear-phishing tactics to maximize the impact of their extortion efforts. The campaign’s discovery has amplified concerns about the security of widely used ERP platforms and the increasing sophistication of ransomware groups like Clop. The incident underscores the importance of timely patch management and the need for organizations to monitor for indicators of compromise associated with this vulnerability. The attack has prompted a rapid response from both Oracle and federal agencies, with advisories and threat intelligence updates being disseminated to help organizations defend against ongoing exploitation. The event has also reignited discussions about the risks posed by zero-day vulnerabilities in critical business applications and the necessity for coordinated industry response. As the situation develops, organizations are advised to remain vigilant, apply all relevant security updates, and review their incident response plans to address potential data theft and extortion scenarios. The Clop group’s exploitation of this zero-day highlights the evolving tactics of ransomware actors and the persistent threat they pose to enterprise environments.
Jun 29, 2026