Loading story…
Barts Health NHS Trust has confirmed that the Cl0p ransomware group gained unauthorized access to one of its invoice databases by exploiting a vulnerability in Oracle E-Business Suite, resulting in the theft of sensitive data. The breach exposed names and addresses of patients billed for care, records of former staff with unresolved salary issues, and payment details for suppliers, though most supplier information was already public. Files related to accounting services for Barking, Havering, and Redbridge University Hospitals NHS Trust since April 2024 were also compromised. The attack occurred in August but was only discovered in November when Cl0p leaked 241 GB of data on its dark web site. Oracle has since patched the exploited flaw, and Barts Health NHS Trust has reported the incident to relevant authorities and is seeking a High Court order to prevent further dissemination of the stolen data.
The Cl0p ransomware group has been actively exploiting the Oracle EBS vulnerability, tracked as CVE-2025-61882, as a zero-day in a broader campaign targeting organizations worldwide. Barts Health NHS Trust, which operates five major hospitals in London, is among several high-profile victims, with the breach highlighting the ongoing threat posed by ransomware actors to healthcare providers. Clinical systems and patient medical records were reportedly not affected, and the risk of data exposure is currently limited to those with access to the dark web leak. Barts Health has advised affected individuals to review any invoices they received to determine if their data was involved in the breach.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
In early December 2025, Barts Health publicly confirmed that Clop was behind the breach of its Oracle E-Business Suite environment and that 241 GB of invoice-related data had been exposed. The trust said the incident affected administrative and accounting data, including some files related to Barking, Havering, and Redbridge University Hospitals NHS Trust, but not patient records or clinical systems.
By early December 2025, Barts Health had sought a High Court injunction to prevent further publication or sharing of the stolen data already posted by Clop. The legal action aimed to suppress dissemination of patient, staff, and supplier information, though reports noted such orders may have limited practical effect on the gang.
After confirming the incident, Barts Health notified relevant authorities including the ICO, National Cyber Security Centre, and Metropolitan Police, and coordinated with NHS England on the response. The trust also warned affected individuals to review invoices and stay alert for phishing, fraud, and social engineering attempts.
In November 2025, Barts Health discovered the breach when exfiltrated files were posted on Clop's dark web leak site. Reports say the leak included invoices and other financial records containing names, addresses, and payment-related information.
Oracle patched the exploited Oracle E-Business Suite zero-day on October 4, 2025, after Clop had already used it in a wider campaign against multiple organizations. The fix came after months of reported exploitation dating back to August 2024 in the broader campaign.
In August 2025, the Clop ransomware group exploited Oracle E-Business Suite vulnerability CVE-2025-61882 to access Barts Health NHS Trust's invoice database. The attackers stole administrative data including patient, former staff, and supplier information, while core IT and clinical systems were not affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
7 references tracked. Mallory keeps watching after this page renders.
upguard-staging.webflow.io
Open sourcego.theregister.com
Open sourcesecurityaffairs.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcehackread.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Cl0p ransomware group orchestrated a significant cyber extortion campaign by exploiting multiple vulnerabilities in Oracle E-Business Suite (EBS), including a previously unknown zero-day flaw tracked as CVE-2025-61882. According to reports, Cl0p leveraged these vulnerabilities to gain unauthorized access to EBS environments and exfiltrate large volumes of sensitive data from several organizations in August 2025. Security researchers, including Charles Carmakal, CTO at Mandiant, and CrowdStrike, confirmed that the attacks began on August 9, 2025, and were part of a coordinated effort targeting Oracle EBS customers. The attackers used the zero-day vulnerability to bypass security controls and escalate privileges within the affected systems, enabling them to steal confidential business information and customer data. The stolen data was then used as leverage in extortion attempts, with Cl0p threatening to publicly release or sell the information unless ransom demands were met. The campaign demonstrated a high level of sophistication, as Cl0p combined the exploitation of the zero-day with other known vulnerabilities to maximize their access and impact. Security advisories highlighted the critical nature of CVE-2025-61882, urging organizations to apply patches and implement additional security measures to protect their Oracle EBS deployments. The incident underscored the ongoing threat posed by ransomware groups exploiting enterprise software vulnerabilities, particularly those that remain unpatched or are not widely known. Oracle customers were advised to review their security posture, monitor for signs of compromise, and engage in threat hunting activities to detect potential intrusions. The attacks also prompted discussions about the importance of timely vulnerability disclosure and patch management in reducing the risk of large-scale data breaches. Industry experts noted that the Cl0p campaign was part of a broader trend of ransomware actors targeting business-critical applications to maximize extortion pressure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) responded by adding the Oracle EBS zero-day to its Known Exploited Vulnerabilities catalog, emphasizing the urgency of remediation. Organizations impacted by the breach faced significant operational and reputational risks, as well as potential regulatory consequences due to the exposure of sensitive data. The incident served as a stark reminder for enterprises to prioritize the security of their ERP systems and to stay vigilant against evolving ransomware tactics. Security vendors and incident response teams collaborated to share indicators of compromise and mitigation strategies, aiming to limit the spread and impact of the Cl0p campaign. The exploitation of Oracle EBS by Cl0p highlighted the persistent threat of zero-day attacks and the need for robust, layered defenses in enterprise environments.
Jul 12, 2026
Threat actors associated with the Cl0p ransomware group have exploited a critical zero-day vulnerability in Oracle E-Business Suite (EBS), tracked as CVE-2025-61882, to facilitate large-scale data theft attacks. The flaw, which carries a CVSS score of 9.8, allows unauthenticated attackers with network access via HTTP to compromise and take control of the Oracle Concurrent Processing component. According to Mandiant CTO Charles Carmakal, Cl0p exploited multiple vulnerabilities in Oracle EBS, including those patched in Oracle's July 2025 update and the newly addressed CVE-2025-61882, to steal significant amounts of data from several organizations in August 2025. The attacks highlight the persistent threat posed by ransomware groups leveraging both known and unknown vulnerabilities to breach enterprise systems. Oracle responded by releasing a patch for CVE-2025-61882, but the incident underscores the importance of timely patch management, as some exploited vulnerabilities had been addressed in previous updates. The exploitation campaign demonstrates Cl0p's technical sophistication and ability to chain multiple vulnerabilities for maximum impact. Victims of these attacks faced the risk of sensitive data exfiltration, with the potential for extortion or public leaks. The incident has raised concerns about the security of widely deployed enterprise resource planning (ERP) platforms, especially those exposed to the internet. Security experts recommend organizations using Oracle EBS urgently apply all relevant patches and review their exposure to internet-facing components. The attacks also serve as a warning about the increasing trend of ransomware groups targeting business-critical applications rather than just endpoints. The campaign has prompted renewed calls for organizations to enhance monitoring, implement network segmentation, and restrict unnecessary external access to ERP systems. The Cl0p group's activity in this case is part of a broader pattern of ransomware operators exploiting high-impact vulnerabilities for data theft and extortion. The incident has been widely discussed in the cybersecurity community as a case study in the risks of delayed patching and the evolving tactics of financially motivated threat actors. Organizations are urged to coordinate with their security vendors and incident response teams to assess potential exposure and strengthen their defenses against similar attacks. The Oracle EBS zero-day exploitation by Cl0p is a stark reminder of the need for continuous vulnerability management and proactive threat intelligence sharing across the industry.
Jun 29, 2026
Cl0p ransomware operators exploited a previously unknown zero-day vulnerability in Oracle E-Business Suite (EBS), enabling unauthorized access to the networks of major organizations, including Cox Enterprises. The attackers leveraged this flaw between August 9-14, 2025, to steal sensitive data before Oracle released a patch on October 5. Cox Enterprises detected the breach in late September and subsequently notified affected individuals after confirming that personal data had been exposed. The Cl0p group later published the stolen information on their dark web extortion portal, listing Cox among 29 new victims. This campaign is part of a broader wave of attacks by Cl0p, which has a history of targeting widely used enterprise platforms through zero-day vulnerabilities. Other high-profile victims in this Oracle EBS campaign include Michelin, Canon, Mazda, Estée Lauder, Broadcom, and even Oracle itself. The group’s tactics mirror previous operations against MOVEit Transfer, GoAnywhere MFT, and Cleo file transfer tools, involving data theft followed by public leaks and extortion attempts. The scale and rapid escalation of the Oracle EBS campaign highlight the ongoing threat posed by Cl0p’s exploitation of critical enterprise software vulnerabilities.
Jun 29, 2026