Washington Post
Disclosed Nov 7, 202510 months ago9,720 affectedConfirmed
Oracle EBS hack exposes Washington Post staff bank and SSN data
The Washington Post said attackers exploiting the Oracle E-Business Suite zero-day accessed parts of its network between July 10 and August 22, 2025, exposing names, bank account and routing numbers, SSNs and tax IDs of 9,720 employees and contractors.
What is known
| People affected | 9,720 (as reported by the organization) |
|---|---|
| Disclosed | Nov 7, 2025 |
| Discovered | Sep 29, 2025 |
| Happened | Jul 10, 2025 |
| Attack | Supply chain |
| Data exposed | Names, Financial, Social Security numbers, Government IDs |
| Sector | Media · US |
| Status | Confirmed |
| Part of | Oracle ebs (2025) |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Washington Postoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Washington Postatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Washington Postjustice.oregon.gov · Official notice | Official notice |
| Washington Post confirms data breach linked to Oracle hackstechcrunch.com · News | News |
| Washington Post data breach impacts nearly 10K employees, contractorsbleepingcomputer.com · News | News |
| Vermont Attorney General: 2025-11-12 The Washington Post Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2025 data breach report: Washington Postin.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Nov 7, 2025 | 9,720 |
| California AGresidents of CA | Nov 12, 2025 | |
| Vermont AGresidents of VT | Nov 12, 2025 | |
| Indiana AGresidents of IN | Nov 12, 2025 | 45 |
| California AGresidents of CA | Jul 13 | |
| Washington AGresidents of WA | Jul 13 | 514 |
| Oregon DOJresidents of OR | Jul 14 | 323 |
Same campaign
Other breaches at Washington Post
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Jul 13, 2026Jul 132 months ago | Jul 132 months ago | Not stated | Retail | Confirmed | 36K |
| Hackers steal 1.27 million user IDs and emails from Post jobs siteJul 7, 201115 years agoHackingUnverified | Jul 7, 201115 years ago | Hacking | Media | Unverified | 1.3M |
History of this record
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2025.pdf · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2025-11-12-washington-post-data-breach-notice-consumers · backfill source
- 2026-09-25 · campaign: empty to oracle-ebs-2025 · seed source
- 2026-09-25 · sector: other to media · seed source
- 2026-09-25 · attack: ransomware to supply-chain · seed source
- 2026-09-25 · data_types: [] to ["names","financial","ssn","government-id"] · seed source
- 2026-09-25 · records_basis: empty to organization · seed source
- 2026-09-25 · records: empty to 9720 · seed source
- 2026-09-25 · disclosed: 2025-11-12 to 2025-11-07 · seed source
- 2026-09-25 · summary: empty to The Washington Post said attackers exploiting the Oracle E-Business Suite zero-day accessed parts of its network between July 10 and August 22, 2025, exposing names, bank account and routing numbers, SSNs and tax IDs of 9,720 employees and · seed source
- 2026-09-25 · title: empty to Oracle EBS hack exposes Washington Post staff bank and SSN data · seed source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · discovered: empty to 2025-09-29 · backfill source
- 2026-09-25 · disclosed: 2026-07-13 to 2025-11-12 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.