Harvard University was targeted in a cyberattack by the Cl0p (Clop) ransomware group, which exploited a zero-day vulnerability (CVE-2025-61882, CVSS 9.8) in Oracle E-Business Suite (EBS). The attackers leaked 1.3 TB of stolen data, including financial, HR, customer, supplier, and inventory information, though Harvard claimed the breach was limited to a small administrative unit. The Cl0p group, known for double extortion (data theft + ransom demands), published the stolen data on its Tor leak site and threatened further exposure. The attack leveraged hacked email accounts and default password resets in Oracle EBS to gain unauthorized access. While Harvard downplayed the incident, the scale of data exfiltration—affecting employees, students, and operational records—suggests severe reputational, financial, and operational risks. The Cl0p group, linked to FIN11 and Russian cybercrime syndicate TA505, has a history of high-profile attacks, including MOVEit, GoAnywhere, and Accellion FTA breaches.

Harvard University is investigating a data breach after the Russian-speaking cybercrime group Clop exploited a vulnerability in the Oracle E-Business Suite (versions 12.2.3–12.2.14). The breach, part of a broader attack targeting over 100 organizations, involved unauthorized data exfiltration, though Harvard’s initial probe suggested only a limited number of parties in a small administrative unit were affected. Clop, known for extorting victims by threatening to leak stolen data, publicly claimed responsibility in late September 2023, demanding ransom payments. While Harvard applied patches and found no evidence of wider system compromise, the incident aligns with Clop’s history of high-profile attacks, including the 2023 MoveIt breach (affecting 2,773+ organizations) and a 2019 ransomware attack on Maastricht University. Oracle acknowledged the vulnerability in October, issuing patches after initially downplaying the risk. The stolen data’s nature remains undisclosed, but Clop’s modus operandi suggests potential exposure of sensitive administrative or personal records.