Loading story…
A breach at an online service operated by Helsingin Uusyrityskeskus exposed usernames and passwords stored in plaintext, allowing anyone who obtained the data to use the credentials immediately without cracking hashes. The affected platform, used to create business plans, may also have exposed sensitive information entered into those plans. Finland’s cybersecurity authorities said the leaked data was not known to be publicly available at the time, but assessed it as likely to have circulated among cybercriminals, and the web service was temporarily shut down.
Separately, public claims alleged that Oracle cloud services had been breached and large volumes of data stolen, although Oracle denied that Oracle Cloud itself was compromised and inconsistencies in the attacker’s samples cast doubt on the claims. Even with that uncertainty, CISA warned of a possible leak tied to an older Oracle cloud environment and said exposed credentials could create serious downstream risk for organizations and users, especially where passwords, tokens, or encryption keys are hardcoded in scripts and automation. Authorities urged organizations to review and rotate credentials, enforce phishing-resistant MFA, monitor for suspicious logins, and strengthen password hygiene and user awareness.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
CISA published guidance related to a potential security incident in an outdated Oracle cloud environment, warning that leaked credentials could pose serious risks to organizations and users. The agency recommended credential review and rotation, phishing-resistant MFA, monitoring for suspicious logins, and improved password hygiene and user awareness.
After the breach claims became public, Oracle stated that Oracle Cloud had not been compromised. The reporting nonetheless raised concern that any incident might instead involve an older Oracle service or legacy cloud environment.
In March 2025, public claims surfaced alleging that Oracle's cloud services had been breached and that a large volume of data had been stolen. Reported inconsistencies and attacker-provided samples cast doubt on whether the claims accurately described a compromise of Oracle Cloud itself.
In response to the breach, Helsingin Uusyrityskeskus temporarily shut down the compromised web service intended for creating business plans. Authorities assessed that while the leaked data was not known to be publicly available online, it had likely circulated among cybercriminals.
A data breach affecting an online service operated by Helsingin Uusyrityskeskus exposed usernames and passwords stored in plaintext, along with possible business plan data entered by users. Because the passwords were not hashed, anyone obtaining the stolen data could immediately use the credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Clop ransomware group exploited a zero-day vulnerability in Oracle E-Business Suite (EBS), tracked as CVE-2025-61882, to compromise major organizations including Schneider Electric, Emerson, Harvard University, and others. The vulnerability allowed unauthenticated remote access to Oracle Concurrent Processing, enabling attackers to exfiltrate large volumes of sensitive data such as ERP records, financial documents, procurement workflows, and engineering files. Clop reportedly maintained access for months, exfiltrating 2.7 terabytes from Emerson and 116 gigabytes from Schneider Electric, with the breach going undetected by traditional monitoring tools. Security experts warn that the impact extends beyond data theft, as attackers may leverage stolen information for extortion, supply chain exploitation, and credential harvesting. Oracle has released patches for CVE-2025-61882 and strongly urges all EBS customers to apply updates immediately. The campaign highlights the risks posed by trusted vendor dependencies and the potential for widespread disruption across critical infrastructure and operational technology supply chains. Attribution remains under investigation, with both Clop and the financially motivated FIN11 group suspected of involvement.
Jun 29, 2026
Oracle has confirmed that its customers are being targeted by data-stealing extortionists who are demanding ransoms in exchange for not leaking stolen data. The attackers are specifically focusing on organizations using Oracle E-Business Suite (EBS), with multiple cybersecurity firms reporting that executives at these organizations have received ransom emails demanding up to $50 million. Oracle has stated that, based on its ongoing investigation, there is no evidence that a zero-day vulnerability is being exploited in these attacks. Instead, the attackers appear to be leveraging previously identified vulnerabilities that were addressed in Oracle's July 2025 critical patch update. Of the 309 security patches issued in that update, nine were for Oracle EBS, with three of those vulnerabilities being remotely exploitable without authentication. The attackers are believed to be gaining access through internet-facing Oracle EBS portals, particularly by targeting local accounts that lack multifactor authentication (MFA), thereby bypassing enterprise single sign-on controls. Cybersecurity firm Halcyon highlighted that the absence of MFA on these accounts is a key factor enabling the attackers to compromise systems. Oracle has strongly reiterated its recommendation that all customers apply the latest critical patch updates to mitigate these risks. The extortion campaign has caused significant concern among Oracle EBS users, as the attackers claim to have accessed sensitive data and are threatening to leak it unless their demands are met. The campaign underscores the importance of timely patch management and the implementation of robust authentication controls, especially for systems exposed to the internet. Security experts warn that organizations failing to update their Oracle EBS installations remain at heightened risk of compromise. The incident has also prompted renewed calls for organizations to review their security posture, particularly regarding privileged account management and the enforcement of MFA. While Oracle continues to investigate the full scope of the campaign, the company maintains that customers who have applied the July 2025 patches are protected against the vulnerabilities being exploited. The situation highlights the ongoing threat posed by extortion-focused cybercriminals and the critical need for organizations to maintain up-to-date security measures. The campaign has also drawn attention to the broader issue of patch adoption lag, as many organizations continue to use outdated software versions despite available fixes. Oracle's response has included direct communication with affected customers and public advisories emphasizing the urgency of patching. The extortion emails and the technical details of the attack have been corroborated by multiple cybersecurity research firms, lending credibility to the reported tactics. The incident serves as a stark reminder of the evolving tactics of cyber extortionists and the persistent risks facing organizations that delay critical security updates.
Jun 29, 2026
Oracle E-Business Suite customers are facing urgent risk from multiple critical vulnerabilities affecting versions `12.2.3` through `12.2.15`, including **CVE-2026-46817** in the Oracle Payments File Transmission component and **CVE-2026-46933** in Oracle Applications Manager. **CVE-2026-46817**, rated `CVSS 9.8`, can be exploited by an unauthenticated remote attacker over HTTP via the `/OA_HTML/ibytransmit` endpoint and may allow takeover of Oracle Payments and broader EBS environments. Oracle addressed the flaw in its May 2026 Critical Security Patch Update, while **CVE-2026-46933**, rated `CVSS 9.9`, was fixed in the June 2026 update as part of a broader set of 245 patched vulnerabilities. Security researchers reported that **CVE-2026-46817** is already being exploited in the wild, with honeypots capturing crafted XML payloads attempting to read `/etc/passwd`, indicating private exploit tooling was in use before any public proof of concept emerged. The exposure is amplified by the number of internet-facing deployments, with Shadowserver identifying more than 450 reachable EBS instances, and government and industry defenders warning organizations to patch immediately and restrict HTTP access to trusted network segments where possible.
Jul 17, 2026