Oracle

The Washington Post confirmed that a zero-day vulnerability in Oracle’s E-Business Suite was exploited by the **Clop ransomware group**, resulting in a large-scale data breach. The attack compromised sensitive information of **9,720 current and former employees and contractors**, exposing personally identifiable data to malicious actors. The breach was part of a broader campaign targeting vulnerabilities in widely used enterprise software, highlighting critical gaps in Oracle’s security posture. The Clop group, known for its double-extortion tactics, likely exfiltrated the data before encrypting systems, amplifying the risk of identity theft, financial fraud, and reputational damage. While the full scope of the attack’s operational impact on Oracle remains undisclosed, the exposure of employee records—including potentially confidential corporate and personal details—poses long-term legal, compliance, and trust-related consequences for the company. The incident underscores the escalating threat of ransomware operations leveraging unpatched software flaws to infiltrate high-profile organizations.

Source: https://www.scworld.com/brief/adidas-breach-affects-korean-customers-data

Oracle cybersecurity rating report: https://www.rankiteo.com/company/oracle

"id": "ORA1385213111725",
"linkid": "oracle",
"type": "Ransomware",
"date": "5/2025",
"severity": "85",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'industry': 'news/publishing',
                        'location': 'United States',
                        'name': 'The Washington Post',
                        'type': 'media organization'}],
 'attack_vector': 'zero-day exploit (Oracle E-Business Suite)',
 'data_breach': {'data_exfiltration': True,
                 'number_of_records_exposed': 9720,
                 'personally_identifiable_information': True,
                 'sensitivity_of_data': 'high (personally identifiable '
                                        'information)',
                 'type_of_data_compromised': ['employee data',
                                              'contractor data']},
 'date_publicly_disclosed': '2025-11-14',
 'description': 'The Washington Post confirmed that information from 9,720 '
                'current and former employees and contractors was compromised '
                'as part of the widespread Oracle E-Business Suite zero-day '
                'attacks conducted by the Clop ransomware operation.',
 'impact': {'data_compromised': True, 'identity_theft_risk': True},
 'initial_access_broker': {'entry_point': 'Oracle E-Business Suite zero-day '
                                          'exploit',
                           'high_value_targets': ['employee data',
                                                  'contractor data']},
 'ransomware': {'data_exfiltration': True, 'ransomware_strain': 'Clop'},
 'references': [{'date_accessed': '2025-11-14',
                 'source': 'CyberScoop (via The Washington Post)'}],
 'threat_actor': 'Clop ransomware group',
 'title': 'Washington Post Data Breach via Oracle E-Business Suite Zero-Day '
          'Exploit by Clop Ransomware',
 'type': ['data breach', 'ransomware attack'],
 'vulnerability_exploited': 'Oracle E-Business Suite zero-day vulnerability'}