Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Browse News Feed Stats Watchlists Beta About Contact

Oracle E-Business Suite compromised-account extortion email campaign

Campaign
First reported
Last updated
Happening score
H score 61
3 unique sources, 7 articles

Summary

Hide ▲

A compromised-account extortion campaign is targeting Oracle E-Business Suite (EBS) customers, with executives at multiple companies receiving emails claiming sensitive data was stolen. The activity began on or before September 29, 2025, and investigators said the messages were sent from hundreds of compromised third-party accounts. Google Threat Intelligence Group (GTIG) and Mandiant said the campaign may have affected dozens of organizations and may involve CVE-2025-61882 plus other attack chains used to gain remote code execution on Oracle EBS servers. Oracle has since issued patches, while the theft claims remain unconfirmed and the campaign shows possible ties to Cl0p and prior FIN11-associated infrastructure.

Related Happenings

Over a dozen companies data exposed after SaaS integration provider Snowflake breach

Data Leak
First: 07.04.2026 22:39 Last: 07.04.2026 22:39 Sources 1

About this happening: A stolen-token attack from a **SaaS integration provider breach** has led to data theft claims affecting **over a dozen companies**, creating immediate exposure and extortion risk...

Open Happening

Madison Square Garden hit by network compromise linked to Cl0p

Incident
First: 02.03.2026 15:53 Last: 02.03.2026 15:53 Sources 1

About this happening: **Madison Square Garden** confirmed a **data breach** that exposed **names and SSNs**, and it has started notifying affected people. The compromise involved a **hosted Oracle E-Bu...

Open Happening

Cl0p Oracle E-Business Suite zero-day extortion campaign

Campaign
First: 02.03.2026 15:53 Last: 02.03.2026 15:53 Sources 1

About this happening: The **Cl0p ransomware and extortion group** is running an **Oracle E-Business Suite** extortion campaign that used **zero-day vulnerabilities** to access data from **more than 100...

Open Happening

Optimizely hit by network compromise

Incident
First: 23.02.2026 20:04 Last: 23.02.2026 20:04 Sources 1

About this happening: **Optimizely** confirmed a **voice-phishing breach** that exposed **basic business contact information**, creating a limited but real follow-on phishing risk. The intrusion touche...

Open Happening

Chinese state-sponsored campaign to hijack Notepad++ update traffic

Campaign
First: 02.02.2026 16:53 Last: 02.02.2026 16:53 Sources 1

About this happening: A **months-long campaign** hijacked **Notepad++ update traffic**, selectively sending some users to malicious servers and threatening the integrity of software updates. The operat...

Open Happening

Timeline

  1. 13.10.2025 14:14 3 articles · 7mo ago

    Harvard University investigates Clop Oracle E-Business Suite breach claim

    Victim Impact Update

    Harvard University said it is investigating a data breach claim after Clop listed the university on its data leak site and said the alleged theft was likely tied to a recently disclosed Oracle E-Business Suite zero-day. Harvard said the issue appears to affect a limited number of parties in a small administrative unit, that it applied Oracle's patch after receiving it, and that it has no evidence of compromise to other University systems.

    Show sources
    Open in new tab
  2. 03.10.2025 15:14 1 articles · 7mo ago

    Oracle urges E-Business Suite customers to apply July 2025 patches

    Mitigation Patch Update

    Oracle told Oracle E-Business Suite customers that its ongoing investigation found the potential use of previously identified vulnerabilities addressed in the July 2025 Critical Patch Update and urged them to apply the latest Critical Patch Updates and contact Oracle support if they need help.

    Show sources
    Open in new tab
  3. 02.10.2025 06:13 2 articles · 7mo ago

    Compromised-account extortion emails target Oracle E-Business Suite executives

    Campaign Scope Update

    Executives at multiple companies received emails claiming that sensitive Oracle E-Business Suite data was stolen, and the activity began on or before September 29, 2025. The messages were launched from hundreds of compromised accounts, and at least one sending account had prior activity associated with FIN11.

    Show sources
    Open in new tab
  4. 02.10.2025 06:13 3 articles · 7mo ago

    Mandiant and Google assess the Oracle E-Business Suite extortion campaign

    Technical Analysis Update

    Mandiant and Google said the extortion emails were being sent from hundreds of compromised accounts, with at least one account previously associated with FIN11, and reported contact addresses linked to the Clop ransomware gang's data leak site. They said there was not enough evidence to determine whether data had actually been stolen and recommended that organizations investigate Oracle E-Business Suite environments for unusual access or compromise.

    Show sources
    Open in new tab