Cox Enterprises, a U.S.-based conglomerate with operations in telecommunications, media, and automotive services (e.g., Cox Communications, Autotrader), suffered a sophisticated data breach via a zero-day exploit (CVE-2025-61882) in Oracle’s E-Business Suite. Hackers, linked to the Cl0p ransomware group, infiltrated the network between August 9–14, 2025, exfiltrating 1.6TB of data—including sensitive personal information of 9,479 individuals (names, addresses, dates of birth, Social Security numbers, and internal documents). The breach was detected in late September 2025, with Cl0p leaking the data on the dark web. The attack exploited an unpatched critical vulnerability (CVSS 9.8) allowing unauthorized database access, heightening risks of identity theft, financial fraud, and reputational damage. Oracle released an emergency patch post-breach, but the delay enabled widespread exploitation across other high-profile targets (e.g., The Washington Post, Harvard University). Cox offered affected parties credit monitoring, though long-term risks persist. The incident underscores vulnerabilities in ERP systems, supply chain security gaps, and the escalating threat of ransomware-as-a-service (RaaS) campaigns targeting enterprise software.

Cox Enterprises disclosed a data breach stemming from a zero-day exploit (CVE-2025-61882) in Oracle E-Business Suite, discovered in late September 2024 after hackers breached its network in August. The Cl0p ransomware group claimed responsibility, exploiting the vulnerability before Oracle released a patch on October 5. While the company confirmed exposure of personal data, the specific types of compromised information (e.g., financial, employee, or customer records) were not disclosed. The delayed detection suggests prolonged unauthorized access, though the full scope of the leak—including whether sensitive data like SSNs, financial details, or proprietary business information was exfiltrated—remains unclear. The incident underscores the risks of third-party software vulnerabilities and the operational gaps in timely threat detection.