Oracle
Disclosed Oct 2, 202511 months agoConfirmed
Clop exploits Oracle E-Business Suite zero-day to steal data from dozens
Starting around September 29, 2025, executives received Clop extortion emails claiming theft of Oracle E-Business Suite data; CrowdStrike and Google found Clop had exploited the zero-day CVE-2025-61882 since at least early August to steal HR, financial and other business data from dozens of organizations.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Oct 2, 2025 |
| Attack | Supply chain |
| Data exposed | Employment, Financial, Internal documents, Social Security numbers, Names |
| Sector | Tech · US |
| Status | Confirmed |
| Part of | Oracle ebs (2025) |
Sources
| Source | |
|---|---|
| Dozens of organizations had data stolen in Oracle-linked hackstechcrunch.com · News | News |
| Clop extortion emails claim theft of Oracle E-Business Suite datableepingcomputer.com · News | News |
| Clop exploited Oracle zero-day for data theft since early Augustbleepingcomputer.com · News | News |
| Oracle Security Alert CVE-2025-61882oracle.com · The organization | The organization |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Oct 2, 2025 |
Same campaign
Other breaches at Oracle
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Hacker steals patient data from legacy Oracle Health (Cerner) serversMar 28, 20251 year agoHackingUnverified | Mar 28, 20251 year ago | Hacking | Healthcare | Unverified | Unknown |
| Hacker steals Oracle Cloud SSO login data; Oracle blames obsolete serversMar 21, 20251 year agoHackingUnverified | Mar 21, 20251 year ago | Hacking | Tech | Unverified | Unknown |
History of this record
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.