INCIDENT REPORT · CP-2025-019

Oracle E-Business Suite zero-day data-theft extortion campaign

L3 · ELEVATEDCONFIRMED

Actors claiming the Cl0p brand mass-exploited an Oracle E-Business Suite zero-day from around August 2025, stole data, and later emailed extortion demands to executives.

Incident ID: CP-2025-019
Disclosure date: 02 OCT 2025
Detection date: Not publicly documented
Affected countries: United States
Plotted location: Cambridge, Massachusetts, United States (Representative confirmed victim (Harvard University); campaign was global)
Threat classification: Level 3 — ELEVATED
Classification rationale: Mass zero-day data theft across many large organizations and sectors.
Attack type: Vulnerability Exploitation
Nature: Malicious activity
Attack vector: Exploitation of Oracle E-Business Suite zero-day CVE-2025-61882 (CVSS 9.8), chained with other flaws, for unauthenticated remote code execution and data theft
Sectors: Education, Transportation, Media, Manufacturing
Critical infrastructure: No
Organizations affected: Harvard University, Envoy Air, The Washington Post, Other Oracle EBS customers
Operational consequences: Google said dozens of organizations may have been affected; Cl0p listed over 100 alleged victims, and Harvard, Envoy Air and The Washington Post confirmed impact. Oracle issued an emergency patch on 4 October 2025.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Claimed by actors using the Cl0p extortion brand; GTIG/Mandiant noted the claimed affiliation

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Oracle E-Business Suite zero-day data-theft extortion campaign

L3 · ELEVATEDCONFIRMED

Actors claiming the Cl0p brand mass-exploited an Oracle E-Business Suite zero-day from around August 2025, stole data, and later emailed extortion demands to executives.

Incident ID

CP-2025-019

Disclosure date

02 OCT 2025

Detection date

Not publicly documented

Affected countries

United States

Plotted location

Cambridge, Massachusetts, United States (Representative confirmed victim (Harvard University); campaign was global)

Threat classification

Level 3 — ELEVATED

Classification rationale

Mass zero-day data theft across many large organizations and sectors.

Attack type

Vulnerability Exploitation

Nature

Malicious activity

Attack vector

Exploitation of Oracle E-Business Suite zero-day CVE-2025-61882 (CVSS 9.8), chained with other flaws, for unauthenticated remote code execution and data theft

Sectors

Education, Transportation, Media, Manufacturing

Critical infrastructure

Organizations affected

Harvard University, Envoy Air, The Washington Post, Other Oracle EBS customers

Operational consequences

Google said dozens of organizations may have been affected; Cl0p listed over 100 alleged victims, and Harvard, Envoy Air and The Washington Post confirmed impact. Oracle issued an emergency patch on 4 October 2025.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Claimed by actors using the Cl0p extortion brand; GTIG/Mandiant noted the claimed affiliation