Michelin Confirms Data Breach in Cl0p’s Oracle EBS Cyberattack Campaign Tire manufacturer Michelin has confirmed a data breach linked to the ongoing cybercrime campaign targeting organizations using Oracle’s E-Business Suite (EBS). The Cl0p ransomware and extortion group, believed to be operated by the FIN11 threat actor cluster, exploited zero-day vulnerabilities in Oracle EBS to access sensitive data from over 100 organizations, including Michelin. Michelin acknowledged the incident, stating that while its systems were protected by robust security measures, attackers leveraged an Oracle EBS zero-day flaw to infiltrate its network. The company reported that only a "small, localized volume of data" was compromised, with no sensitive or technical IT information affected. No ransomware was deployed, and global operations remained unaffected. Despite Michelin’s assurance that the breach was contained, Cl0p published over 315GB of allegedly stolen files on its leak site. Metadata analysis suggests the data originated from an Oracle EBS environment. Michelin emphasized its swift response, confirming that corrective actions were taken and the vulnerability has since been patched. This attack follows similar breaches at Madison Square Garden, auto parts supplier LKQ, the University of Phoenix, and Korean Air, all tied to the same Oracle EBS campaign. The incidents highlight the growing threat posed by sophisticated extortion groups exploiting enterprise software vulnerabilities.

Korean Air Employee Data Exposed in Cl0p Supply-Chain Breach Korean Air confirmed a data breach affecting approximately 30,000 current and former employees after a supply-chain attack on its catering and duty-free subsidiary, Korean Air Catering & Duty-Free (KC&D). The incident stemmed from a critical vulnerability (CVE-2025-61882) in Oracle E-Business Suite (EBS), which the Cl0p ransomware group exploited to steal and leak nearly 500 GB of archives. The exposed data includes full names and bank account numbers, heightening risks of identity theft and financial fraud. Other personal details, such as emails or addresses, were reportedly not compromised. KC&D was added to Cl0p’s leak site on November 21, following a pattern similar to the group’s 2023 MOVEit attack, which impacted hundreds of organizations worldwide. The breach mirrors the MOVEit incident in scale, with dozens of global entities—including Envoy Air, Harvard University, Schneider Electric, and Barts Health NHS Trust—confirming exposure via the same EBS vulnerability. Oracle released a patch in early October after companies began receiving extortion demands from Cl0p, but the damage had already spread. Cl0p, a Russian-linked ransomware group, has claimed responsibility for both the EBS and MOVEit attacks, targeting high-profile victims like Shutterfly, Procter & Gamble, and Community Health Systems. The group’s tactics underscore the growing threat of supply-chain attacks on enterprise software.