Cl0p Ransomware Group Exploits Oracle E-Business Suite Zero-Day
The Cl0p ransomware group launched a large-scale extortion campaign by exploiting a zero-day vulnerability (possibly CVE-2025-61882) in Oracle's E-Business Suite (EBS). This led to critical data breaches for dozens of large corporations, with over 100 companies allegedly impacted. The exploitation activity was observed as early as August 9, 2025, weeks before a patch was available, and suspicious activity dated back to July 10, 2025. The threat actors exfiltrated a significant amount of data from impacted organizations and sent high-volume emails to executives demanding payment.
Signal context
First seen: Sep 29, 2025
Last updated: Jun 19, 2026
Status: Public signal
Key points
- Cl0p ransomware group exploited a zero-day vulnerability in Oracle E-Business Suite.
- Over 100 companies were allegedly impacted, with data exfiltrated.
- Exploitation activity was observed from July 2025, with a widespread campaign starting September 29, 2025.
Signal analysis
BetaThis analysis groups the signal by industry, likely incident action and impacted security area. It helps compare this signal with other published signals without treating the labels as final determinations.
Sector: Finance and Insurance
Likely country: Location not provided
Watch ransomware, endpoint compromise and business interruption exposure.
- Source type: outside the affected organization
Impact area: Availability
- 3 signals in the same sector
- 2 signals with the same likely impact area
- 5 signals linked to this organization/domain
External sources
Related signals
Grouped by why the signal is relevant.
Oracle Affected by FortiBleed Campaign
Oracle was identified as one of over 22,000 corporate domains affected by the FortiBleed campaign. A Russian-speaking criminal group compromised Fortinet firewall and VPN devices globally, exfiltrating credentials and potentially gaining full network access.
ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273)
The ShinyHunters threat group exploited a zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft PeopleTools, a critical remote code execution flaw with a CVSS score of 9.8. The campaign, observed between May 27 and June 9, 2026, targeted over 100 global organizations, with a significant focus on the higher education sector. The vulnerability allowed unauthenticated remote code execution without user interaction. Stolen data from compromised organizations was subsequently published on ShinyHunters' data leak site, and some victims received extortion demands. Oracle released a security advisory on June 10, 2026, after the exploitation was already underway.
Oracle Cloud Authentication Data Breach by 'rose87168'
A threat actor identified as 'rose87168' claimed to have breached Oracle Cloud's federated Single Sign-On (SSO) login servers and exfiltrated approximately 6 million records, impacting over 140,000 tenants. The stolen data reportedly includes Java Key Store (JKS) files, encrypted SSO and LDAP passwords, and Enterprise Manager JPS keys. While Oracle initially denied a breach of its main Oracle Cloud Infrastructure (OCI) platform, it acknowledged a security incident involving two obsolete servers where usernames were accessed. Cybersecurity firms and independent researchers confirmed the validity of some data samples shared by the threat actor. The attacker was active since January 2025 and sought assistance to decrypt stolen data, demanding payments to prevent further exposure. CISA issued guidance on credential risks associated with a potential legacy Oracle cloud compromise.
Oracle Health (Cerner) Legacy Server Breach
In a separate incident from the Oracle Cloud breach, Oracle Health (formerly Cerner), a provider of electronic health record (EHR) systems, experienced a data breach. A hacker reportedly used stolen credentials to access legacy servers that had not yet been migrated to Oracle Cloud, leading to the exfiltration of healthcare records from various hospitals in the United States. The incident began on January 22, 2025, and Oracle first noticed the breach on February 20, 2025. The attacker is allegedly extorting Oracle Health customers, demanding cryptocurrency payments to withhold publishing the stolen data, which likely includes protected health information.
American Express Insider Data Breach Reported
American Express was involved in an insider data breach where an employee accessed the personal financial information of an individual. An investigation by the Australian Privacy Commissioner found the company breached privacy laws by failing to implement adequate restrictions on staff access to customer accounts.
French National Bank Account Registry (FICOBA) Data Breach
The Fichier National des Comptes Bancaires et Assimilés (FICOBA), France's national bank account registry, experienced a data breach in late January 2026, potentially compromising 1.2 million accounts.