MSI
Company Details
Linkedin ID:
micros-systems-inc
Employees number:
1,733
Number of followers:
25,845
NAICS:
5112
Industry Type:
Homepage:
oracle.com
IP Addresses:
0
Company ID:
MIC_9907232
Scan Status:
In-progress
MICROS Systems Inc Company CyberSecurity Posture
oracle.com
Thank you for visiting MICROS Systems, Inc. In 2014, MICROS was acquired by Oracle, and as of February 13, 2015, this page will remain inactive. Please visit Oracle's LinkedIn page for updates on Oracle Hospitality: https://www.linkedin.com/company/oracle.
MICROS Systems Inc A.I CyberSecurity Scoring
MSI Risk Score (AI oriented)Between 750 and 799
MSI
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
MSI Global Score (TPRM)XXXX
MSI
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
MSI Company CyberSecurity News & History
Past Incidents
24
Attack Types
4
Oracle Corporation
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: On July 10, 2013, Fidelity Investments experienced a data breach reported by the California Office of the Attorney General on July 31, 2013. An unauthorized individual gained access to a report containing sensitive personal information of **Oracle Corporation employees**, including **names and Social Security numbers**. The breach exposed confidential employee data, though the exact number of affected individuals remains undisclosed. The incident highlights a significant security lapse, as the compromised data could facilitate identity theft, financial fraud, or targeted phishing attacks against the affected employees. While the breach did not directly impact Fidelity’s customers, the exposure of third-party (Oracle) employee records underscores vulnerabilities in data handling and access controls. The breach’s discovery and reporting delay (21 days) may have further exacerbated risks, as affected individuals were left uninformed during this period. Such breaches erode trust in financial institutions’ ability to safeguard sensitive information, potentially leading to reputational damage and regulatory scrutiny. The nature of the stolen data—Social Security numbers—makes it particularly high-risk, as this information is immutable and highly valuable to cybercriminals for long-term exploitation.
Oracle
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: Oracle confirmed a security incident involving obsolete servers that resulted in the theft and leakage of user credentials. Although Oracle Cloud services remained uncompromised, affected servers were part of what was formerly known as Oracle Cloud Classic. The breach brought to light legacy data, including user emails, hashed passwords, and usernames, some dating back to 2025. The event underscores the risks of maintaining outdated systems and the importance of clear communication in the face of cybersecurity incidents. Primary concerns revolve around the potential misuse of the stolen credential information and Oracle's subsequent efforts to mitigate any associated risks.
Oracle
Breach
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Oracle recently faced allegations of a data breach, with a threat actor claiming to have stolen 6 million records from Oracle Cloud's SSO login servers. Oracle has denied any breach, stating there was no compromise of their cloud services and customers' data remained secure. The threat actor, rose87168, attempted to sell the data and claimed the information includes SSO passwords, Java Keystore files, key files, and JPS keys from Oracle Cloud servers. Despite encrypted and hashed passwords requiring decryption or cracking, the impact of such a breach—if proven accurate—could potentially be significant, undermining trust in Oracle's cloud security and potentially impacting customers whose data was compromised.
Oracle Corporation
Breach
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Oracle Corporation endured a data breach affecting its Gen 1 servers, with no complete PII exposure but involving 6 million data records including usernames, email addresses, and hashed passwords. Sensitive credentials related to SSO and LDAP were also compromised. The breach, attributed to the threat actor 'rose87168' via a 2020 Java exploit, resulted in the theft of JKS files and Enterprise Manager JPS keys from legacy systems approximately 16 months old. Oracle has informed clients and taken steps to bolster Gen 1 server security while maintaining that its Gen 2 servers and primary Oracle Cloud infrastructure remain secure.
Oracle
Breach
Rankiteo Explanation
Attack that could injure or kill people
Description: Oracle faced two data security incidents with reported poor incident communication. An attacker allegedly accessed login servers and legacy Cerner data, leading to customers' personal information being at risk. Missteps in Oracle's response include outright denial, potentially misleading statements, and accusations of deleting evidence online, compounding the damage to their reputation.
Oracle
Breach
Rankiteo Explanation
Attack threatening the organization's existence
Description: A Russian cybercrime group breached 100 computer systems belonging to Oracle's retail division and MICROS point-of-sale credit card payment systems. It did not expose corporate networks and other cloud and service offerings that were not affected by the breach. Oracle urged Micros customers to change their passwords and any passwords used by Micros representatives to access their on-premise systems.
Oracle
Cyber Attack
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Oracle is facing a high-volume extortion campaign targeting executives of its **E-Business Suite (EBS)** customers. Attackers are sending emails claiming unauthorized access to EBS data—critical for finance, supply chain, and CRM operations—demanding ransom under threats of data exposure or operational disruption. While Oracle has not confirmed actual data theft, the campaign risks **legal, reputational, and operational fallout**, including potential ERP downtime, financial workflow disruptions, and supply-chain interruptions. The attack exploits unverified claims to pressure CFOs and CISOs, leveraging fear of regulatory penalties, customer distrust, and system outages. Oracle has urged immediate patching (July 2025 Critical Patch Update) and hardening of environments, including MFA enforcement, SSO token rotation, and third-party integration audits. The incident highlights vulnerabilities in ERP systems, where even unproven threats can trigger costly incident-response measures, executive stress, and preemptive crisis management (e.g., tabletop exercises for breach scenarios).
Oracle Hospitality
Cyber Attack
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: A large-scale phishing campaign targeted Oracle Hospitality through malicious search engine advertisements (malvertising), impersonating its services to deceive users. Victims were redirected to typosquatted domains mimicking legitimate login pages, harvesting credentials, email addresses, phone numbers, and passwords. The attackers bypassed multi-factor authentication (MFA) by capturing real-time one-time passwords (OTP) via SMS or email codes, gaining unauthorized access to cloud-based property management systems.The breach exposed sensitive guest data, including personal information and payment details, stored in these platforms. Technical analysis revealed Russian-speaking threat actors behind the operation, using sophisticated beaconing techniques to track victims’ geolocation, session duration, and engagement. The campaign posed significant risks to Oracle Hospitality’s operational integrity, customer trust, and financial security, with potential downstream impacts on booking systems and guest privacy.Security researchers highlighted the need for phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn) and adaptive risk assessments to mitigate future threats. The incident underscores the growing sophistication of industry-specific cyberattacks targeting hospitality providers.
Oracle (E-Business Suite customers)
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: A new extortion campaign targeted executives across multiple companies using **Oracle E-Business Suite**, with threat actors (potentially the **Clop ransomware gang/FIN11**) sending emails claiming theft of sensitive data. The campaign, active since at least **September 29, 2025**, leveraged **hundreds of compromised email accounts**, some linked to prior FIN11 activity. While the emails included contact details tied to Clop’s data leak site, **Mandiant and Google Cloud have not yet confirmed actual data theft**. The attack exploits potential vulnerabilities in Oracle’s platform, though no zero-day confirmation exists. Organizations were urged to investigate unusual access in their Oracle environments. Clop, known for **ransomware deployment and data extortion**, has historically exploited file transfer flaws (e.g., **Cleo zero-days in 2024**) to steal corporate data. The U.S. State Department offers a **$10M reward** for ties between Clop and foreign governments. The incident remains under investigation, with risks including **financial extortion, reputational damage, and potential data leaks** if claims are substantiated.
Oracle
Ransomware
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: The Washington Post confirmed that a zero-day vulnerability in Oracle’s E-Business Suite was exploited by the **Clop ransomware group**, resulting in a large-scale data breach. The attack compromised sensitive information of **9,720 current and former employees and contractors**, exposing personally identifiable data to malicious actors. The breach was part of a broader campaign targeting vulnerabilities in widely used enterprise software, highlighting critical gaps in Oracle’s security posture. The Clop group, known for its double-extortion tactics, likely exfiltrated the data before encrypting systems, amplifying the risk of identity theft, financial fraud, and reputational damage. While the full scope of the attack’s operational impact on Oracle remains undisclosed, the exposure of employee records—including potentially confidential corporate and personal details—poses long-term legal, compliance, and trust-related consequences for the company. The incident underscores the escalating threat of ransomware operations leveraging unpatched software flaws to infiltrate high-profile organizations.
Oracle
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: The **Clop ransomware gang** exploited a **zero-day vulnerability** in **Oracle’s E-Business Suite**, a critical enterprise software used for managing customer data, HR files, and corporate operations. The attack, active since at least **July 10**, allowed hackers to steal **significant amounts of sensitive data**, including **personal information of corporate executives and employees**, as well as **customer data** from affected organizations. Oracle initially claimed the vulnerabilities were patched, but later confirmed the zero-day flaw enabled **remote exploitation without authentication**, meaning attackers could breach systems without credentials.Google’s security researchers revealed that **dozens of organizations** were compromised, with the Clop gang using the stolen data for **extortion campaigns**. The group has a history of **mass-hacking** via unpatched vulnerabilities in file transfer tools (e.g., **MOVEit, GoAnywhere**), amplifying risks of **large-scale data leaks**. Oracle’s delayed acknowledgment and the **ongoing exploitation** of the flaw suggest prolonged exposure, increasing potential damage to **financial records, executive identities, and corporate intellectual property**.
Oracle
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: The **Clop ransomware gang** exploited a **critical zero-day vulnerability (CVE-2025-61882)** in **Oracle E-Business Suite (EBS)**, specifically within the **BI Publisher Integration component**, to conduct **data theft attacks** since at least **August 2025**. The flaw allowed **unauthenticated remote code execution (RCE)** via a single HTTP request, enabling attackers to steal **sensitive corporate documents** from unpatched systems. Oracle patched the vulnerability in early October 2025, but not before Clop launched an **extortion campaign**, emailing executives at multiple victim organizations to demand ransoms in exchange for not leaking the stolen data.The attack leveraged a **vulnerability chain** exposed by leaked proof-of-concept (PoC) exploits from the **Scattered Lapsus$ Hunters** group, increasing the risk of further exploitation by other threat actors. Clop’s campaign mirrors past high-profile breaches, including **MOVEit Transfer (2,770+ organizations affected)**, **Accellion FTA**, and **GoAnywhere MFT**, reinforcing its reputation for **large-scale data theft via zero-days**. Oracle urged immediate patching, warning that **internet-exposed EBS applications** remain prime targets. The U.S. State Department has even offered a **$10 million reward** for intelligence linking Clop to foreign state sponsorship, underscoring the attack’s severity.
Oracle Corporation
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: The Clop ransomware gang (Graceful Spider) exploited a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite (EBS), an enterprise resource planning system used for order management, procurement, and logistics. The unauthenticated remote code execution (RCE) flaw allowed attackers to bypass authentication via the **OA_HTML/SyncServlet** endpoint and inject malicious XSLT templates through **OA_HTML/RF.jsp**, granting full control over sensitive ERP data. Oracle was listed on Clop’s dark web leak site, suggesting internal corporate data—potentially financial and employee records—was compromised. The attack leveraged reused infrastructure from prior campaigns (e.g., 2023 MOVEit exploits), with extortion emails sent to victims demanding ransom to prevent data leaks. Over **1,025 victims** and **$500M+ in extorted funds** since 2019 highlight Clop’s persistence. The breach poses severe risks to Oracle’s supply chain integrity, operational continuity, and reputation, with potential cascading effects on clients like Mazda, Humana, and the Washington Post, also listed as victims.
Oracle Corporation
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: The Clop ransomware gang (Graceful Spider) breached Oracle Corporation by exploiting a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite (EBS), an unauthenticated remote code execution (RCE) flaw with a CVSS score of 9.8. The attack bypassed authentication via the **SyncServlet** endpoint and injected malicious XSLT templates through **RF.jsp**, granting full control over enterprise systems. Oracle’s internal data and customer information were exposed, with Clop listing the company on its dark web leak site under a 'PAGE CREATED' status. The breach aligns with Clop’s broader campaign targeting high-profile victims (e.g., Mazda, Humana, Washington Post) via extortion emails threatening public data leaks unless ransoms are paid. The attack leveraged reused infrastructure from prior exploits (e.g., 2023 MOVEit vulnerability), with 96 distinct IPs tied to Russian-linked service providers. The incident underscores the severe risk posed by unpatched EBS instances, which manage critical functions like procurement, logistics, and financial records globally.
Oracle
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Hackers linked to the Russian ransomware gang **Clop (FIN11)** are exploiting vulnerabilities in **Oracle E-Business Suite**, a critical enterprise platform managing finance, HR, and supply chain data. The threat actors claim to have stolen sensitive corporate information and are conducting a **high-volume extortion campaign**, targeting executives across multiple organizations via compromised email accounts. While the exact scope of the breach remains unconfirmed, the group has historically leveraged stolen data for ransom demands rather than system disruption. Oracle previously disclosed a **January 2024 incident** where hackers accessed legacy systems and stole client credentials, raising concerns about credential reuse and exposure. The current campaign, launched on **September 29, 2024**, mirrors Clop’s past tactics—such as the **MOVEit attacks**—which impacted **2,773 organizations** and exposed **96 million records**. The group has demanded ransoms under the threat of leaking stolen data, using email addresses tied to Clop’s official leak site. Mandiant and Google Threat Intelligence Group (GTIG) are investigating but have not yet verified the full extent of the breach or the legitimacy of the stolen data claims.
Oracle
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Hackers linked to the **Clop ransomware gang** exploited zero-day vulnerabilities in **Oracle E-Business Suite**, a critical enterprise software used globally for managing customer databases, employee records, and HR files. The attackers compromised hundreds of email accounts, abused password-reset functions to gain unauthorized access to Oracle’s web portals, and exfiltrated sensitive corporate data. They then launched an extortion campaign, sending threatening emails to executives at numerous large organizations—demanding ransom payments (e.g., **$50 million in one case**) under the threat of leaking stolen data on Clop’s public leak site. While Google’s Mandiant team has not yet verified the full extent of the breach, the attack leveraged Oracle’s widely used business software, potentially exposing **tens of millions of individuals’ personal and financial records**. The incident highlights systemic risks in supply-chain attacks, where a single vulnerability in a major vendor like Oracle can cascade across thousands of dependent enterprises.
Oracle (E-Business Suite)
Ransomware
Rankiteo Explanation
Attack that could injure or kill people
Description: The FBI issued an urgent warning about a **critical vulnerability in Oracle’s E-Business Suite**, exploited by cybercriminals to execute **data theft and ransomware attacks**, particularly targeting hospitals. The flaw allows attackers to **steal sensitive patient data, encrypt systems, disrupt healthcare operations, and potentially delay life-saving treatments** (e.g., surgeries, cancer care). While Oracle released a patch, the risk remains high due to the **sophistication of nation-state and criminal hackers**, who exploit unpatched systems to **shut down vital hospital infrastructure**, jeopardizing patient safety and operational continuity.The attack vector threatens **healthcare’s most critical functions**, including **core health systems, payment processes, and emergency services**, with cascading effects on **public trust and regulatory compliance**. Hospitals—already strained by resource gaps—face **financial losses from ransom demands, reputational damage from breaches, and legal liabilities** if patient data (e.g., medical records, financial details) is exposed. The AHA emphasizes that such attacks could **escalate to life-threatening disruptions**, aligning with broader warnings about cyber threats to **national health security**.
Oracle
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: Oracle released an emergency patch for **CVE-2025-61882** (CVSS 9.8), a critical zero-day vulnerability in its **E-Business Suite**, actively exploited by the **Cl0p ransomware group** and potentially the **Scattered LAPSUS$ Hunters**. The flaw allows unauthenticated remote attackers to execute arbitrary code via HTTP, compromising the **Oracle Concurrent Processing** component. Cl0p leveraged this in a **high-volume phishing campaign**, stealing large volumes of sensitive data from multiple victims in **August 2025**. Indicators of compromise (IoCs) include malicious IP addresses (e.g., **200.107.207[.]26**, **185.181.60[.]11**), reverse shell payloads, and exploit scripts (e.g., *oracle_ebs_nday_exploit_poc_...*). Mandiant warned of **mass exploitation**, urging organizations to investigate potential breaches even after patching, as attackers may have already exfiltrated data. The incident highlights the risk of **supply-chain attacks** via unpatched enterprise software, with Cl0p’s campaign targeting financial, HR, and operational data—potentially disrupting business continuity and exposing customers/employees to fraud or regulatory penalties.
Oracle
Vulnerability
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Oracle issued an **emergency security update** to patch a critical **information disclosure vulnerability (CVE-2025-61884, CVSS 7.5)** in its **E-Business Suite (EBS) Runtime UI component (versions 12.2.3–12.2.14)**. The flaw allows **unauthenticated remote attackers** to exploit it over a network **without credentials**, granting access to **sensitive corporate resources**, including financial, employee, or customer data. The vulnerability was part of a broader **extortion campaign** linked to the **Cl0p ransomware group (FIN11)**, which exploited a separate zero-day (CVE-2025-61882, CVSS 9.8) to **steal data** and send **extortion emails** to executives. While Oracle did not confirm active exploitation of CVE-2025-61884, the **urgent patch** suggests high risk. Attackers leveraged **hacked email accounts** and **default password resets** to gain credentials, potentially exposing **confidential business data**, **intellectual property**, or **operational secrets**. The incident highlights risks of **supply-chain attacks** and **data breaches** in enterprise software, with possible **financial fraud, reputational damage, or regulatory penalties** if exploited.
Oracle
Vulnerability
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Oracle has patched a critical zero-day vulnerability (CVE-2025-61882) in its **E-Business Suite**, actively exploited by the **Clop hacking group** to steal **personal information of corporate executives** and extort victims. The flaw allows remote exploitation without credentials, enabling mass data theft from thousands of organizations using the suite for **customer data and employee HR files**. Initially, Oracle downplayed the threat, linking extortion emails to older patched vulnerabilities from July. However, the newly discovered zero-day confirms ongoing exploitation since at least **August 2024**, with Clop demanding ransom to prevent leaking stolen data. Google’s Mandiant reported **widespread attacks**, though not all victims have been contacted yet. The breach poses severe risks to **executive privacy, corporate reputation, and operational security**, with potential cascading effects on Oracle’s enterprise clients globally.
Oracle Cloud
Breach
Rankiteo Explanation
Attack threatening the organization’s existence
Description: The cyberattack on Oracle Cloud orchestrated by 'rose87168' led to the theft of 6 million records potentially affecting over 140,000 tenants. Exfiltrated data includes sensitive JKS files, encrypted SSO passwords, key files, and JPS keys. This information is now sold on dark web forums. The breach, exploiting CVE-2021-35587, poses risks of unauthorized access and corporate espionage given the type of data stolen. Oracle's compromised subdomain and vulnerable software version highlight security gaps and raise concerns of lateral movement within the cloud environment.
Oracle Cloud
Breach
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Oracle Cloud faced an alleged data breach, claimed by a threat actor named Rose87168, affecting over 140,000 tenants and potentially exposing 6 million records including sensitive SSO credentials, LDAP passwords, and OAuth2 keys. Despite initial denials, evidence from security researchers at CloudSEK and confirmation from Trustwave SpiderLabs suggest the breach is legitimate, likely due to a critical vulnerability (CVE-2021-35587) in Oracle Access Manager. The breach's nature and the threat to sell or release the data indicate a severe security lapse potentially compromising personal and financial information.
Oracle Health
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: A breach at Oracle Health has resulted in the theft of patient data from legacy servers impacting multiple US healthcare organizations and hospitals. Unauthorized access by a threat actor after January 22, 2025, led to the exfiltration of Electronic Health Records (EHR) data with potential violations of HIPAA laws. There is uncertainty whether ransomware was involved, but Oracle Health's response has been criticized for lack of transparency and failure to provide proper guidance and documentation, leaving hospitals to navigate the aftermath themselves.
Oracle Health
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Oracle Health, the healthcare subsidiary of Oracle Corporation, experienced a data breach involving legacy Cerner data migration servers. This incident, which Oracle has communicated to its customers through private letters, is reported to have potentially exposed sensitive customer data. The breach is a consequence of Oracle's acquisition of Cerner Corp, a notable electronic health records business, as Oracle aimed to transition the healthcare software to cloud infrastructure. The significance of the data involved and the potential ramifications of such breaches in the healthcare sector underline the serious nature of this cybersecurity event.
MSI Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for MSI
Incidents vs Software Development Industry Average (This Year)
No incidents recorded for MICROS Systems Inc in 2025.
Incidents vs All-Companies Average (This Year)
No incidents recorded for MICROS Systems Inc in 2025.
Incident Types MSI vs Software Development Industry Avg (This Year)
No incidents recorded for MICROS Systems Inc in 2025.
Incident History — MSI (X = Date, Y = Severity)
MSI cyber incidents detection timeline including parent company and subsidiaries
MSI Company Subsidiaries
Thank you for visiting MICROS Systems, Inc. In 2014, MICROS was acquired by Oracle, and as of February 13, 2015, this page will remain inactive. Please visit Oracle's LinkedIn page for updates on Oracle Hospitality: https://www.linkedin.com/company/oracle.
Loading...
MSI Similar Companies
PhonePe Group is India’s leading fintech company, proudly recognized as India’s #1 Trusted Digital Payments* Brand for three consecutive years. Our flagship product, the PhonePe app was launched in August 2016, has rapidly become the preferred consumer payments app in India. In just eight years, Pho
DiDi
DiDi Global Inc. is a leading mobility technology platform. It offers a wide range of app-based services across Asia Pacific, Latin America, and other global markets, including ride hailing, taxi hailing, designated driving, hitch and other forms of shared mobility as well as certain energy and vehi
HubSpot
HubSpot is a leading CRM platform that provides software and support to help businesses grow better. Our platform includes marketing, sales, service, and website management products that start free and scale to meet our customers’ needs at any stage of growth. Today, thousands of customers around th
Shopify is a leading global commerce company, providing trusted tools to start, grow, market, and manage a retail business of any size. Shopify makes commerce better for everyone with a platform and services that are engineered for reliability, while delivering a better shopping experience for consu
PedidosYa
We’re the delivery market leader in Latin America. Our platform connects over 77.000 restaurants, supermarkets, pharmacies and stores with millions of users. Nowadays we operate in more than 500 cities in Latinamerica. And we are now over 3.400 employees. PedidosYa is available for iOS, Android and
Booking.com
A career at Booking.com is all about the journey, helping you explore new challenges in a place where you can be your best self. With plenty of exciting twists, turns and opportunities along the way. We’ve always been pioneers, on a mission to shape the future of travel through cutting edge techno
Airbnb
Airbnb was born in 2007 when two hosts welcomed three guests to their San Francisco home, and has since grown to over 5 million hosts who have welcomed over 2 billion guest arrivals in almost every country across the globe. Every day, hosts offer unique stays, experiences and services that make it p
Sage
At Sage, we knock down barriers with information, insights, and tools to help your business flow. We provide businesses with software and services that are simple and easy to use, as we work with you to give you that feeling of confidence. Customers trust our Payroll, HR, and Finance software to m
SAP is the leading enterprise application and business AI company. We stand at the intersection of business and technology, where our innovations are designed to directly address real business challenges and produce real-world impacts. Our solutions are the backbone for the world’s most complex and
.png)
MSI CyberSecurity News
November 24, 2025 01:00 PM
Trend Micro previews security package for full-stack AI protection
Japanese cybersecurity software company Trend Micro Inc. today gave a preview of its soon-to-be-launched Trend Vision One AI Security...
October 28, 2025 07:00 AM
Trend Micro Launches End-to-End Protection for Agentic AI Systems with NVIDIA
PRNewswire/ -- Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global cybersecurity leader, today announced a new integration with NVIDIA...
October 27, 2025 07:00 AM
Trend Micro Awards Over $1,000,000 to Ethical Hackers – Company Announcement
The latest company information, including net asset values, performance, holding & sectors weighting, changes in voting rights,...
October 16, 2025 07:00 AM
Apollo Micro Systems Secures Defense Orders Worth INR 392.70 Million, Gains Technology Transfer Approval
Apollo Micro Systems has been declared the lowest bidder for defense-related orders worth INR 392.70 million, split between DRDO (INR 43.00...
September 18, 2025 07:00 AM
Apollo Micro Systems Signs MoU to Boost Cybersecurity
Apollo Micro Systems inks MoU with Sibersentinel & Zoom Tech to co-develop cybersecurity solutions for govt, finance & critical infra;...
September 18, 2025 07:00 AM
Apollo Micro Systems Forges Cybersecurity Alliances with Sibersentinel and Zoom Technologies
Apollo Micro Systems Limited (AMSL) has signed MoUs with Sibersentinel Technologies Limited and Zoom Technologies (India) Private Limited to...
September 18, 2025 07:00 AM
Apollo Micro Systems Ties Up with Sibersentinel, Zoom for Cybersecurity Technologies
Apollo Micro Systems has entered into a memorandum of understanding with Sibersentinel Technologies and Zoom Technologies to jointly design,...
September 10, 2025 07:00 AM
What Is AI Security?
AI security refers to both the tools, technologies, and security measures organizations use to secure their AI stack as well as the use of...
September 01, 2025 07:00 AM
Trend Micro introduces: A new generation of smart cybersecurity
Trend Micro unveils new Agentic AI technology that proactively manages cyber risks, reduces alert overload, and upgrades legacy SIEM systems...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
MSI CyberSecurity History Information
Official Website of MICROS Systems Inc
The official website of MICROS Systems Inc is https://www.oracle.com/industries/food-beverage/index.html.
MICROS Systems Inc’s AI-Generated Cybersecurity Score
According to Rankiteo, MICROS Systems Inc’s AI-generated cybersecurity score is 752, reflecting their Fair security posture.
How many security badges does MICROS Systems Inc’ have ?
According to Rankiteo, MICROS Systems Inc currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does MICROS Systems Inc have SOC 2 Type 1 certification ?
According to Rankiteo, MICROS Systems Inc is not certified under SOC 2 Type 1.
Does MICROS Systems Inc have SOC 2 Type 2 certification ?
According to Rankiteo, MICROS Systems Inc does not hold a SOC 2 Type 2 certification.
Does MICROS Systems Inc comply with GDPR ?
According to Rankiteo, MICROS Systems Inc is not listed as GDPR compliant.
Does MICROS Systems Inc have PCI DSS certification ?
According to Rankiteo, MICROS Systems Inc does not currently maintain PCI DSS compliance.
Does MICROS Systems Inc comply with HIPAA ?
According to Rankiteo, MICROS Systems Inc is not compliant with HIPAA regulations.
Does MICROS Systems Inc have ISO 27001 certification ?
According to Rankiteo,MICROS Systems Inc is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of MICROS Systems Inc
MICROS Systems Inc operates primarily in the Software Development industry.
Number of Employees at MICROS Systems Inc
MICROS Systems Inc employs approximately 1,733 people worldwide.
Subsidiaries Owned by MICROS Systems Inc
MICROS Systems Inc presently has no subsidiaries across any sectors.
MICROS Systems Inc’s LinkedIn Followers
MICROS Systems Inc’s official LinkedIn profile has approximately 25,845 followers.
NAICS Classification of MICROS Systems Inc
MICROS Systems Inc is classified under the NAICS code 5112, which corresponds to Software Publishers.
MICROS Systems Inc’s Presence on Crunchbase
No, MICROS Systems Inc does not have a profile on Crunchbase.
MICROS Systems Inc’s Presence on LinkedIn
Yes, MICROS Systems Inc maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/micros-systems-inc.
Cybersecurity Incidents Involving MICROS Systems Inc
As of November 27, 2025, Rankiteo reports that MICROS Systems Inc has experienced 24 cybersecurity incidents.
Number of Peer and Competitor Companies
MICROS Systems Inc has an estimated 26,613 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at MICROS Systems Inc ?
Incident Types: The types of cybersecurity incidents that have occurred include Breach, Cyber Attack, Ransomware, Vulnerability and Malware.
How does MICROS Systems Inc detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with password change recommendation, and communication strategy with customer advisory, and containment measures with password reset, and remediation measures with malware removal, and communication strategy with letter to users, and communication strategy with criticized for lack of transparency, and third party assistance with cloudsek, third party assistance with trustwave spiderlabs, and communication strategy with private letters to customers, and communication strategy with outright denial, communication strategy with potentially misleading statements, communication strategy with accusations of deleting evidence online, and remediation measures with informed clients, remediation measures with bolstered gen 1 server security, and law enforcement notified with yes (california office of the attorney general), and third party assistance with okta threat intelligence (analysis by moussa diallo), and containment measures with monitoring for suspicious domain registrations, containment measures with blocking known malicious domains, and remediation measures with implementation of phishing-resistant authentication (e.g., passkeys, fido2 webauthn), remediation measures with adaptive risk assessments for unusual access patterns, and communication strategy with customer advisories about impersonation attempts, communication strategy with industry-wide alerts, and enhanced monitoring with real-time tracking of typosquatted domains, enhanced monitoring with beaconing detection, and incident response plan activated with recommended (investigate oracle e-business suite environments), and third party assistance with mandiant (google cloud), third party assistance with gtig, and enhanced monitoring with recommended (for unusual access), and and third party assistance with mandiant (google cloud), third party assistance with google threat intelligence group (gtig), and communication strategy with public warning via cybersecurity firms (mandiant, gtig), communication strategy with media outreach (recorded future news), and incident response plan activated with yes (by affected organizations and firms like halcyon and mandiant), and third party assistance with mandiant (google’s incident response unit), third party assistance with halcyon (counter-ransomware firm), and communication strategy with public disclosure via media (techcrunch, bloomberg); anonymous reporting channel for affected executives, and and third party assistance with mandiant (google cloud), and containment measures with emergency patch release (cve-2025-61882), containment measures with advisory for customer mitigation, and remediation measures with patch application, remediation measures with investigation into potential prior compromise, and communication strategy with public advisory, communication strategy with linkedin post by oracle cso, communication strategy with mandiant technical alert, and enhanced monitoring with recommended for customers to detect prior compromise, and incident response plan activated with recommended: erp-compromise tabletop exercises within 24–48 hours, and law enforcement notified with recommended: preserve email headers/artifacts for law enforcement or threat intelligence, and containment measures with patch verification (july 2025 cpu), containment measures with rotate sso tokens, containment measures with enforce mfa on ebs admin/service accounts, containment measures with review privileged roles and recent admin logins for anomalies, and remediation measures with inventory and re-authorize third-party integrations (apis, connectors, file transfers), remediation measures with monitor interface logs for unusual spikes/failures, and communication strategy with route extortion emails via security and legal channels, communication strategy with pre-draft customer and regulator communications, and enhanced monitoring with monitor erp integration points for anomalies, and incident response plan activated with yes (oracle released patch and urged immediate installation), and third party assistance with google mandiant (investigation and advisory), and containment measures with patch release (cve-2025-61882), containment measures with indicators of compromise (iocs) shared with customers, and remediation measures with urgent patch installation recommended for all customers, and communication strategy with public security advisory by oracle cso rob duhart, communication strategy with linkedin post by google mandiant cto charles carmakal, and incident response plan activated with oracle security alert (urgent patching advisory), and third party assistance with crowdstrike (detection and analysis), third party assistance with mandiant (investigation), third party assistance with google threat intelligence group (gtig), and containment measures with patching cve-2025-61882, containment measures with disabling exposed ebs components, and communication strategy with oracle customer advisory, communication strategy with public disclosure of poc risks, and enhanced monitoring with recommended for oracle ebs environments, and incident response plan activated with yes (google and oracle), and third party assistance with google security researchers, and remediation measures with oracle security advisory issued, remediation measures with technical indicators shared by google for detection, and communication strategy with public advisory by oracle, communication strategy with blog post by google, communication strategy with media statements, and enhanced monitoring with recommended (google provided indicators for detection), and third party assistance with aha’s preferred cybersecurity provider program, third party assistance with microsoft (via rural health resiliency program), and and containment measures with immediate software patch installation (oracle’s e-business suite), containment measures with long-term cyber incident response planning, and remediation measures with cybersecurity assessments, remediation measures with cloud capability evaluations, remediation measures with curated cyber and ai training, remediation measures with foundational cyber certifications for it staff, and communication strategy with aha advisories with federal law enforcement input, communication strategy with public awareness campaigns (e.g., cybersecurity awareness month), and incident response plan activated with yes (oracle released emergency security alerts and patches), and third party assistance with google threat intelligence, third party assistance with mandiant, third party assistance with crowdstrike, and containment measures with emergency patching (cve-2025-61884 & cve-2025-61882), containment measures with urgent advisory for customers to apply updates, and remediation measures with patch deployment, remediation measures with mitigation guidance for unpatched systems, and communication strategy with public security advisories, communication strategy with direct customer notifications, and enhanced monitoring with recommended (oracle advised customers to monitor for exploitation attempts), and remediation measures with patch released in october 2025 security alert, and third party assistance with security researchers (the raven file), and remediation measures with oracle released patch in october 2025..
Incident Details
Can you provide details on each incident ?
Title: Oracle MICROS Point-of-Sale System Breach
Description: A Russian cybercrime group breached 100 computer systems belonging to Oracle's retail division and MICROS point-of-sale credit card payment systems. It did not expose corporate networks and other cloud and service offerings that were not affected by the breach. Oracle urged Micros customers to change their passwords and any passwords used by Micros representatives to access their on-premise systems.
Type: Data Breach
Attack Vector: Network Intrusion
Threat Actor: Russian Cybercrime Group
Title: Oracle MICROS Point-of-Sale System Breach
Description: In a letter to users of its MICROS point-of-sale system, Oracle Security states that it has found and fixed malicious malware in a few legacy MICROS systems. The IT Giant claims that payment card data is encrypted and held by MICROS systems, with no impact on other services. The accounts that MICROS employees use to remotely operate payment terminals across the globe need to have their passwords updated. The hackers gained access to customers' accounts and took control of their MICROS point-of-sale (POS) terminals by breaking into the Oracle MICROS payment terminals' troubleshooting site and stealing their login credentials.
Type: Malware Infection
Attack Vector: Credential Theft
Vulnerability Exploited: Weak Password Management
Motivation: Unauthorized Access
Title: Alleged Data Breach at Oracle Cloud
Description: Oracle recently faced allegations of a data breach, with a threat actor claiming to have stolen 6 million records from Oracle Cloud's SSO login servers. Oracle has denied any breach, stating there was no compromise of their cloud services and customers' data remained secure. The threat actor, rose87168, attempted to sell the data and claimed the information includes SSO passwords, Java Keystore files, key files, and JPS keys from Oracle Cloud servers. Despite encrypted and hashed passwords requiring decryption or cracking, the impact of such a breach—if proven accurate—could potentially be significant, undermining trust in Oracle's cloud security and potentially impacting customers whose data was compromised.
Type: Data Breach
Threat Actor: rose87168
Motivation: Financial Gain
Title: Cyberattack on Oracle Cloud by 'rose87168'
Description: The cyberattack on Oracle Cloud orchestrated by 'rose87168' led to the theft of 6 million records potentially affecting over 140,000 tenants. Exfiltrated data includes sensitive JKS files, encrypted SSO passwords, key files, and JPS keys. This information is now sold on dark web forums. The breach, exploiting CVE-2021-35587, poses risks of unauthorized access and corporate espionage given the type of data stolen. Oracle's compromised subdomain and vulnerable software version highlight security gaps and raise concerns of lateral movement within the cloud environment.
Type: Data Breach
Attack Vector: Exploitation of CVE-2021-35587
Vulnerability Exploited: CVE-2021-35587
Threat Actor: 'rose87168'
Motivation: Unauthorized accessCorporate espionage
Title: Data Breach at Oracle Health
Description: A breach at Oracle Health has resulted in the theft of patient data from legacy servers impacting multiple US healthcare organizations and hospitals. Unauthorized access by a threat actor after January 22, 2025, led to the exfiltration of Electronic Health Records (EHR) data with potential violations of HIPAA laws. There is uncertainty whether ransomware was involved, but Oracle Health's response has been criticized for lack of transparency and failure to provide proper guidance and documentation, leaving hospitals to navigate the aftermath themselves.
Type: Data Breach
Attack Vector: Unauthorized Access
Title: Oracle Cloud Data Breach
Description: Oracle Cloud faced an alleged data breach, claimed by a threat actor named Rose87168, affecting over 140,000 tenants and potentially exposing 6 million records including sensitive SSO credentials, LDAP passwords, and OAuth2 keys. Despite initial denials, evidence from security researchers at CloudSEK and confirmation from Trustwave SpiderLabs suggest the breach is legitimate, likely due to a critical vulnerability (CVE-2021-35587) in Oracle Access Manager. The breach's nature and the threat to sell or release the data indicate a severe security lapse potentially compromising personal and financial information.
Type: Data Breach
Attack Vector: Critical Vulnerability
Vulnerability Exploited: CVE-2021-35587
Threat Actor: Rose87168
Motivation: Data Theft, Financial Gain
Title: Oracle Health Data Breach
Description: Oracle Health, the healthcare subsidiary of Oracle Corporation, experienced a data breach involving legacy Cerner data migration servers. This incident, which Oracle has communicated to its customers through private letters, is reported to have potentially exposed sensitive customer data. The breach is a consequence of Oracle's acquisition of Cerner Corp, a notable electronic health records business, as Oracle aimed to transition the healthcare software to cloud infrastructure. The significance of the data involved and the potential ramifications of such breaches in the healthcare sector underline the serious nature of this cybersecurity event.
Type: Data Breach
Title: Oracle Data Security Incidents
Description: Oracle faced two data security incidents with reported poor incident communication. An attacker allegedly accessed login servers and legacy Cerner data, leading to customers' personal information being at risk. Missteps in Oracle's response include outright denial, potentially misleading statements, and accusations of deleting evidence online, compounding the damage to their reputation.
Type: Data Breach
Attack Vector: Login Server AccessLegacy Cerner Data Access
Title: Oracle Corporation Gen 1 Servers Data Breach
Description: Oracle Corporation endured a data breach affecting its Gen 1 servers, with no complete PII exposure but involving 6 million data records including usernames, email addresses, and hashed passwords. Sensitive credentials related to SSO and LDAP were also compromised. The breach, attributed to the threat actor 'rose87168' via a 2020 Java exploit, resulted in the theft of JKS files and Enterprise Manager JPS keys from legacy systems approximately 16 months old. Oracle has informed clients and taken steps to bolster Gen 1 server security while maintaining that its Gen 2 servers and primary Oracle Cloud infrastructure remain secure.
Type: Data Breach
Attack Vector: 2020 Java Exploit
Vulnerability Exploited: Java Vulnerability
Threat Actor: rose87168
Title: Oracle Security Incident Involving Obsolete Servers
Description: Oracle confirmed a security incident involving obsolete servers that resulted in the theft and leakage of user credentials. Although Oracle Cloud services remained uncompromised, affected servers were part of what was formerly known as Oracle Cloud Classic. The breach brought to light legacy data, including user emails, hashed passwords, and usernames, some dating back to 2025. The event underscores the risks of maintaining outdated systems and the importance of clear communication in the face of cybersecurity incidents. Primary concerns revolve around the potential misuse of the stolen credential information and Oracle's subsequent efforts to mitigate any associated risks.
Type: Data Breach
Vulnerability Exploited: Obsolete Servers
Title: Fidelity Investments Data Breach (2013) Affecting Oracle Corporation Employees
Description: The California Office of the Attorney General reported a data breach involving Fidelity Investments on July 31, 2013. The breach occurred on July 10, 2013, when an unauthorized individual accessed a report that included personal information of Oracle Corporation employees, such as names and Social Security numbers. The total number of individuals affected is unknown.
Date Detected: 2013-07-10
Date Publicly Disclosed: 2013-07-31
Type: Data Breach
Threat Actor: Unauthorized Individual
Title: Large-Scale Phishing Operation Targeting Hospitality Industry via Malvertising
Description: A sophisticated phishing campaign is targeting the hospitality industry through malicious search engine advertisements (malvertising). Cybercriminals impersonate at least thirteen hotel and vacation rental service providers (including Oracle Hospitality and Airbnb) to steal credentials and breach cloud-based property management systems. The operation employs typosquatted domains, fake login pages, and advanced tactics to bypass multi-factor authentication (MFA), including real-time capture of one-time passwords (OTP) and SMS/email codes. Technical analysis suggests Russian-speaking threat actors, with infrastructure leveraging Russian datacenter proxies and beaconing techniques for victim tracking. The campaign poses significant risks to guest data, payment information, and operational systems across the sector.
Type: phishing
Attack Vector: malicious advertisements (malvertising)typosquatted domainsfake login pagessocial engineering
Vulnerability Exploited: human trust in search engine adslack of phishing-resistant authenticationweak MFA implementations
Threat Actor: Russian-speaking cybercriminalsunknown APT/group (potential initial access brokers)
Motivation: financial gaindata theftfraud (e.g., unauthorized bookings)sale of credentials on dark web
Title: Extortion Campaign Targeting Oracle E-Business Suite Systems
Description: Mandiant and Google are tracking a new extortion campaign where executives at multiple companies received emails claiming that sensitive data was stolen from their Oracle E-Business Suite systems. The campaign began in late September 2025, with extortion emails sent from hundreds of compromised accounts, some linked to the FIN11 threat group (associated with Clop ransomware). The emails contain contact addresses listed on Clop's data leak site, but there is insufficient evidence to confirm if data was actually stolen. Organizations are advised to investigate their Oracle E-Business Suite environments for unusual access or compromise.
Date Detected: 2025-09-29
Date Publicly Disclosed: 2025-09-29
Type: Extortion
Attack Vector: Compromised Email AccountsPotential Zero-Day Exploitation (Oracle E-Business Suite)
Threat Actor: FIN11 (suspected)Clop Ransomware Gang (potential link)
Motivation: Financial Gain (Extortion)
Title: Clop Ransomware Gang Targets Oracle E-Business Suite in Extortion Campaign
Description: Hackers possibly connected to the Russian ransomware gang Clop (FIN11) are attempting to extort corporate executives by threatening to leak sensitive information allegedly stolen through Oracle's E-Business Suite. The campaign, tracked by Mandiant and Google Threat Intelligence Group (GTIG), involves extortion emails sent from compromised accounts, with claims of data theft from Oracle’s widely used business platform. The group has historically exploited vulnerabilities in file transfer tools (e.g., MOVEit, GoAnywhere) to steal and sell data for ransom. Investigations are ongoing, and the veracity of the claims remains unconfirmed.
Date Detected: 2023-09-29
Date Publicly Disclosed: 2023-10-04
Type: Data Breach
Attack Vector: Phishing/Spoofed EmailsExploitation of Vulnerabilities in Oracle E-Business SuiteCompromised Accounts
Threat Actor: Clop (FIN11)Potentially Impersonating Clop
Motivation: Financial Gain (Extortion/Ransom)
Title: Clop Ransomware Group Targets Executives with Extortion Emails After Alleged Oracle E-Business Suite Data Theft
Description: Hackers associated with the Clop ransomware group are sending extortion emails to executives at large organizations, claiming to have stolen sensitive data from Oracle's E-Business Suite. The emails, sent from hundreds of compromised accounts, include contact addresses listed on Clop’s data leak site. The group is known for exploiting zero-day vulnerabilities to breach multiple organizations simultaneously. In one case, a $50 million ransom was demanded. The hackers abused Oracle’s default password-reset function to gain access to web-portals.
Date Detected: 2023-09-29
Date Publicly Disclosed: 2023-09-29
Type: ransomware
Attack Vector: compromised email accountsabuse of default password-reset functionzero-day vulnerabilities
Vulnerability Exploited: unknown zero-day vulnerabilities in Oracle E-Business Suitedefault password-reset function abuse
Threat Actor: Clop ransomware gang
Motivation: financial gain
Title: Critical Zero-Day Exploit in Oracle E-Business Suite (CVE-2025-61882) Linked to Cl0p Ransomware Attacks
Description: Oracle released an emergency update to patch a critical zero-day vulnerability (CVE-2025-61882, CVSS 9.8) in its E-Business Suite, actively exploited by the Cl0p ransomware group in a high-volume data theft campaign. The flaw allows unauthenticated remote code execution via HTTP in the Oracle Concurrent Processing component. Indicators of compromise (IoCs) suggest involvement of the Scattered LAPSUS$ Hunters group, with evidence of exploit PoCs and malicious IP activity. Mandiant reported the campaign as part of a broader wave of attacks targeting Oracle EBS vulnerabilities, including those patched in July 2025 and the newly disclosed zero-day.
Date Detected: 2025-08
Date Publicly Disclosed: 2025-08
Type: Data Breach
Attack Vector: Network-based (HTTP)Unauthenticated Remote Code Execution
Vulnerability Exploited: CVE-2025-61882 (CVSS 9.8) - Oracle E-Business Suite Concurrent Processing Component
Threat Actor: Cl0p Ransomware GroupScattered LAPSUS$ Hunters
Motivation: Data TheftFinancial Gain (Ransomware)Exploitation of Zero-Day for Mass Compromise
Title: High-Volume Extortion Campaign Targeting Oracle E-Business Suite (EBS) Executives
Description: A high-volume extortion campaign is targeting executives with emails claiming unauthorized access to Oracle E-Business Suite (EBS) data. The campaign poses risks of executive pressure, potential data exposure, and ERP downtime across finance, supply-chain, and CRM workflows. While Oracle has not confirmed any customer data theft, it has urged EBS customers to apply the July 2025 Critical Patch Update (CPU) and harden their environments. Google described the campaign as 'high volume' but could not verify the data-theft claims.
Type: extortion
Attack Vector: phishing/extortion emailspotential exploitation of unpatched vulnerabilities in Oracle EBS
Vulnerability Exploited: unpatched Oracle EBS vulnerabilities (addressed in July 2025 CPU)
Motivation: financial extortionpotential data theft for resale or further exploitation
Title: Oracle E-Business Suite Zero-Day Vulnerability Exploitation by Clop Hacking Group
Description: Oracle has patched a zero-day vulnerability (CVE-2025-61882) in its Oracle E-Business Suite, which the Clop hacking group is actively exploiting to steal personal information about corporate executives. The vulnerability allows exploitation over a network without authentication. Oracle urged customers to install the patch immediately, as thousands of organizations globally use the E-Business Suite for critical operations, including storing customer and HR data. The Clop group has been sending extortion emails to executives since late September 2025, demanding ransom payments to prevent the publication of stolen personal data. The exploitation campaign began in August 2025, following Oracle's July patches for previously identified vulnerabilities.
Date Detected: 2025-08-01
Date Publicly Disclosed: 2025-10-02
Type: Data Breach
Attack Vector: Network-based exploitation (no authentication required)Extortion emails
Vulnerability Exploited: CVE-2025-61882 (Zero-day in Oracle E-Business Suite)
Threat Actor: Clop (hacking group linked to ransomware and extortion)
Motivation: Financial gain (extortion)Data theft
Title: Clop Ransomware Exploits Oracle E-Business Suite Zero-Day (CVE-2025-61882) in Data Theft Attacks
Description: The Clop ransomware gang has been exploiting a critical Oracle E-Business Suite (EBS) zero-day bug (CVE-2025-61882) in data theft attacks since at least early August 2025. The vulnerability, patched by Oracle in early October 2025, resides in the BI Publisher Integration component of Oracle EBS's Concurrent Processing, allowing unauthenticated remote code execution (RCE) via a single HTTP request. Clop has been using this flaw to steal sensitive documents and extort victims via email campaigns. Other threat actors, including GRACEFUL SPIDER, may also be involved. Oracle has urged customers to patch immediately, as the public disclosure of the PoC exploit is expected to escalate attacks.
Date Detected: 2025-08-09
Date Publicly Disclosed: 2025-10-03
Type: Data Theft
Attack Vector: Unauthenticated Remote Code Execution (RCE)HTTP Request ExploitationEmail-Based Extortion
Vulnerability Exploited: CVE-2025-61882 (Oracle E-Business Suite BI Publisher Integration Component)
Threat Actor: Clop Ransomware GangGRACEFUL SPIDER (moderate confidence)
Motivation: Financial Gain (Extortion)Data Theft for Leverage
Title: Clop Extortion Gang Exploits Zero-Day in Oracle E-Business Suite to Steal Corporate Data
Description: Security researchers at Google reported that the Clop extortion gang exploited multiple security vulnerabilities, including a zero-day bug, in Oracle’s E-Business Suite software to steal significant amounts of data from dozens of organizations. The campaign, active since at least July 10, targeted corporate executives and involved extortion emails. Oracle initially claimed the vulnerabilities were patched in July, but later confirmed the zero-day could be exploited remotely without credentials. The Clop gang, linked to Russia, is known for mass-hacking campaigns exploiting unknown vulnerabilities in managed file transfer tools and enterprise software.
Date Detected: 2023-10-05T00:00:00Z
Date Publicly Disclosed: 2023-10-05T00:00:00Z
Type: Data Breach
Attack Vector: Exploitation of Zero-Day Vulnerability (CVE Unknown)Network-Based Attack (No Credentials Required)Extortion Emails
Vulnerability Exploited: Zero-Day in Oracle E-Business SuitePreviously Patched Vulnerabilities (Exploited Post-Patch)
Threat Actor: Clop Ransomware/Extortion Gang
Motivation: Financial Gain (Extortion)Data Theft for Dark Web Sale
Title: Critical Vulnerability in Oracle’s E-Business Suite Exploited for Data Theft and Ransomware Attacks in Healthcare Sector
Description: The FBI issued an urgent warning about a critical vulnerability in Oracle’s E-Business Suite, enabling cybercriminals to conduct data theft and ransomware attacks. The vulnerability, described as a 'stop-what-you’re-doing and patch immediately' issue, poses significant risks to healthcare organizations, including hospitals. Oracle has released a patch to mitigate the threat. The healthcare sector, a long-standing top target for cyberattacks, faces escalating threats from sophisticated criminal and nation-state actors. These attacks disrupt patient care, encrypt systems, and compromise sensitive data. The American Hospital Association (AHA) emphasizes the need for a whole-of-government approach to counter these threats, including federal intervention, threat intelligence sharing, and offensive cyber capabilities. The AHA provides resources, partnerships, and advisory services to help hospitals bolster their cybersecurity defenses, particularly for under-resourced rural facilities.
Type: Data Theft
Attack Vector: Exploitation of Critical Vulnerability in Oracle’s E-Business Suite
Vulnerability Exploited: Critical Security Vulnerability in Oracle’s E-Business Suite (Patch Available)
Threat Actor: Sophisticated CybercriminalsNation-State Sponsored Actors
Motivation: Financial GainDisruption of Healthcare ServicesData Theft
Title: Oracle E-Business Suite Vulnerabilities (CVE-2025-61884 & CVE-2025-61882) Exploited in Extortion Campaigns
Description: Oracle issued emergency security updates to address critical vulnerabilities (CVE-2025-61884 and CVE-2025-61882) in its E-Business Suite (EBS). The flaws, exploitable remotely without authentication, were linked to extortion campaigns by the Cl0p ransomware group (FIN11). Attackers exploited these vulnerabilities to steal sensitive data, send extortion emails to executives, and potentially gain control of Oracle Concurrent Processing components. Oracle urged immediate patching to mitigate risks, while Google Mandiant and CrowdStrike attributed the attacks to Cl0p with moderate confidence. A proof-of-concept (POC) exploit was disclosed on October 3, 2025, increasing the likelihood of further exploitation by threat actors.
Date Detected: 2025-07-10
Date Publicly Disclosed: 2025-10-14
Type: Vulnerability Exploitation
Attack Vector: NetworkHTTPExploitation of Public-Facing Application
Vulnerability Exploited: CVE-2025-61884 (CVSS 7.5 - Information Disclosure in Runtime UI)CVE-2025-61882 (CVSS 9.8 - Remote Code Execution in BI Publisher Integration/Concurrent Processing)
Threat Actor: Cl0p Ransomware Group (Graceful Spider)FIN11Potential involvement of Scattered Spider, Slippy Spider (Lapsus$), ShinyHunters
Motivation: Financial GainData TheftExtortion
Title: Washington Post Data Breach via Oracle E-Business Suite Zero-Day Exploit by Clop Ransomware
Description: The Washington Post confirmed that information from 9,720 current and former employees and contractors was compromised as part of the widespread Oracle E-Business Suite zero-day attacks conducted by the Clop ransomware operation.
Date Publicly Disclosed: 2025-11-14
Type: data breach
Attack Vector: zero-day exploit (Oracle E-Business Suite)
Vulnerability Exploited: Oracle E-Business Suite zero-day vulnerability
Threat Actor: Clop ransomware group
Title: Clop Ransomware Exploits Zero-Day CVE-2025-61882 in Oracle E-Business Suite
Description: The Clop ransomware gang (Graceful Spider) breached Oracle Corporation's internal systems by exploiting a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite (EBS). The unauthenticated remote code execution (RCE) flaw allowed attackers to bypass authentication via the OA_HTML/SyncServlet endpoint and inject malicious XSLT templates via OA_HTML/RF.jsp, granting full control over ERP data. The attack, part of a broader supply chain campaign, targeted Oracle and other major entities like Mazda, Humana, and the Washington Post. Clop listed Oracle on its dark web leak site, threatening to release financial and personal records unless ransom demands were met. Evidence links the attack infrastructure to prior MOVEit exploits (CVE-2023-34362), with 96 distinct IPs identified, primarily hosted on Russian-based providers.
Date Detected: 2025-06
Date Publicly Disclosed: 2025-10
Type: Ransomware
Attack Vector: Unauthenticated Remote Code Execution (RCE)Authentication Bypass via SyncServletXSLT Injection via RF.jsp
Vulnerability Exploited: CVE-2025-61882 (Critical, CVSS 9.8)
Threat Actor: Clop Ransomware Gang (Graceful Spider)
Motivation: Financial GainData Extortion
Title: Clop Ransomware Gang Exploits Zero-Day Vulnerability in Oracle E-Business Suite (CVE-2025-61882)
Description: The Clop ransomware gang (Graceful Spider) claimed to have breached Oracle Corporation’s internal systems by exploiting a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite (EBS). The unauthenticated remote code execution (RCE) flaw, with a CVSS score of 9.8, was actively exploited since August 2025, two months before Oracle released a patch in October 2025. The attack leveraged the OA_HTML/SyncServlet endpoint for authentication bypass and malicious XSLT injection via OA_HTML/RF.jsp. Clop listed Oracle and high-profile customers (e.g., Mazda, Humana, Washington Post) on its dark web leak site, threatening data exposure unless ransom demands were met. Evidence suggests Oracle may have been compromised via its own unpatched EBS software, risking exposure of internal corporate and customer data.
Date Detected: 2025-08
Type: Ransomware Attack
Attack Vector: Unauthenticated Remote Code Execution (RCE)Authentication Bypass via SyncServletXSLT Injection via RF.jsp
Vulnerability Exploited: Cve Id: CVE-2025-61882, Affected Product: Oracle E-Business Suite (Versions 12.2.3 – 12.2.14), Vulnerability Type: Unauthenticated Remote Code Execution (RCE), Cvss Score: 9.8, Authentication BypassXSLT InjectionPatch Status: Patched in October 2025 (exploited since August 2025).
Threat Actor: Name: ['Clop Ransomware Gang', 'Graceful Spider']Origin: Russian-linkedConfirmed Victims: 1025Ransom Extracted: $500 million (since 2019)Associated Infrastructure: {'ip_addresses': 96, 'reused_ips_from_moveit': 41, 'geographic_distribution': [{'country': 'Germany', 'ip_count': 16}, {'country': 'Brazil', 'ip_count': 13}, {'country': 'Panama', 'ip_count': 12}], 'service_providers': ['Russian-based']}
Motivation: Financial GainData ExtortionReputation Damage
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Breach.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Troubleshooting Site, CVE-2021-35587, malvertising (malicious search engine ads)typosquatted domains, Compromised Email Accounts, Compromised Email AccountsPotential Exploitation of Oracle E-Business Suite Vulnerabilities, compromised email accountsOracle E-Business Suite web-portals, Oracle E-Business Suite Concurrent Processing Component (via HTTP), phishing/extortion emails targeting executives, CVE-2025-61882 (Oracle E-Business Suite zero-day), CVE-2025-61882 (Oracle EBS BI Publisher), Zero-Day Vulnerability in Oracle E-Business Suite (Network-Based, No Authentication Required), Exploitation of Unpatched Vulnerability in Oracle’s E-Business Suite, Exploitation of Oracle EBS Vulnerabilities (CVE-2025-61882, CVE-2025-61884)Hacked User EmailsDefault Password Reset Mechanisms, Oracle E-Business Suite zero-day exploit, OA_HTML/SyncServlet (Authentication Bypass) & OA_HTML/RF.jsp (XSLT Injection) and Oracle E-Business Suite (EBS) SyncServlet endpoint.
Impact of the Incidents
What was the impact of each incident ?
Incident : Data Breach ORA392622
Data Compromised: Credit card payment information
Systems Affected: MICROS Point-of-Sale Systems
Payment Information Risk: True
Incident : Malware Infection MIC1953291023
Data Compromised: Payment card data
Systems Affected: MICROS Point-of-Sale Systems
Payment Information Risk: ['High']
Incident : Data Breach ORA344032125
Data Compromised: Sso passwords, Java keystore files, Key files, Jps keys
Systems Affected: Oracle Cloud SSO login servers
Brand Reputation Impact: Potential undermining of trust in Oracle's cloud security
Incident : Data Breach ORA615032225
Data Compromised: Jks files, Encrypted sso passwords, Key files, Jps keys
Incident : Data Breach ORA526032825
Data Compromised: Electronic health records (ehr)
Systems Affected: Legacy Servers
Legal Liabilities: Potential HIPAA violations
Incident : Data Breach ORA805033125
Data Compromised: Sso credentials, Ldap passwords, Oauth2 keys
Identity Theft Risk: True
Payment Information Risk: True
Incident : Data Breach ORA455040125
Systems Affected: legacy Cerner data migration servers
Incident : Data Breach ORA656040225
Data Compromised: Personal Information
Systems Affected: Login ServersLegacy Cerner Data
Brand Reputation Impact: Damaged Reputation
Incident : Data Breach ORA956040325
Data Compromised: Usernames, Email addresses, Hashed passwords, Sso credentials, Ldap credentials, Jks files, Enterprise manager jps keys
Systems Affected: Gen 1 serverslegacy systems
Incident : Data Breach ORA1045040925
Data Compromised: User emails, Hashed passwords, Usernames
Systems Affected: Oracle Cloud Classic Servers
Incident : Data Breach ORA720082025
Data Compromised: Names, Social security numbers
Identity Theft Risk: High (PII exposed)
Incident : phishing ORA805090225
Data Compromised: Guest personal information, Payment data, Booking system credentials, Operational data
Systems Affected: cloud-based property management systemsguest messaging platformsauthentication systems
Operational Impact: potential unauthorized access to booking systemsreputation damagecustomer trust erosion
Brand Reputation Impact: high (due to impersonation of major brands like Oracle Hospitality and Airbnb)
Identity Theft Risk: ['high (guest PII and payment data exposed)']
Payment Information Risk: ['high (credit card details and transaction data at risk)']
Incident : Extortion ORA4062140100225
Systems Affected: Oracle E-Business Suite (potential)
Brand Reputation Impact: Potential (due to extortion claims)
Incident : Data Breach ORA1092210100225
Data Compromised: Potentially finance, hr, and supply chain data (oracle e-business suite)
Systems Affected: Oracle E-Business Suite
Brand Reputation Impact: High (Potential Reputation Damage Due to Extortion Threats)
Identity Theft Risk: Potential (If PII Stolen)
Incident : ransomware ORA0193001100225
Data Compromised: Customer databases, Employee information, Human resources files
Systems Affected: Oracle E-Business Suite web-portals
Brand Reputation Impact: potential reputational damage due to extortion threats and data breach claims
Identity Theft Risk: high (due to compromised PII in HR and customer databases)
Incident : Data Breach ORA5662156100625
Data Compromised: Large amounts of data (exact scope undisclosed)
Systems Affected: Oracle E-Business Suite (Concurrent Processing Component)
Brand Reputation Impact: High (due to zero-day exploitation and association with Cl0p ransomware)
Identity Theft Risk: Potential (depends on stolen data types)
Incident : extortion ORA2192321100625
Systems Affected: Oracle E-Business Suite (EBS)
Operational Impact: potential disruption to finance, supply-chain, and CRM workflows
Brand Reputation Impact: reputational risk due to unverified claims and executive targeting
Legal Liabilities: potential legal fallout from unverified ransomware claims
Incident : Data Breach ORA4993249100625
Data Compromised: Personal information of corporate executives, Customer data, Employee hr files
Systems Affected: Oracle E-Business Suite
Brand Reputation Impact: High (extortion campaign targeting executives, potential data leaks)
Identity Theft Risk: High (personal information of executives targeted)
Incident : Data Theft ORA1692116100725
Data Compromised: Sensitive documents, Potentially pii or corporate data
Systems Affected: Oracle E-Business Suite (EBS) with unpatched BI Publisher Integration
Brand Reputation Impact: High (due to extortion and potential data leaks)
Identity Theft Risk: ['Potential (if PII was stolen)']
Incident : Data Breach ORA4202442101025
Data Compromised: Corporate executive data, Customer data, Employee hr files, Sensitive corporate data
Systems Affected: Oracle E-Business Suite
Brand Reputation Impact: High (Associated with Mass Hacking Campaign)
Identity Theft Risk: High (Personal Information of Executives Compromised)
Incident : Data Theft ORA4092340101025
Downtime: True
Operational Impact: Disruption of Patient Care, Delay in Clinical Operations, Potential Shutdown of Vital Systems
Brand Reputation Impact: Potential Erosion of Trust in Healthcare Providers Due to Data Breaches and Service Disruptions
Identity Theft Risk: True
Incident : Vulnerability Exploitation ORA0832608101425
Data Compromised: Sensitive resources, Potential oracle e-business suite data (as claimed in extortion emails)
Systems Affected: Oracle E-Business Suite (Versions 12.2.3–12.2.14)Runtime UI ComponentBI Publisher IntegrationConcurrent Processing Component
Operational Impact: Potential Disruption Due to Unauthorized AccessEmergency Patching Requirements
Brand Reputation Impact: Potential Reputation Damage Due to Data Theft Claims and Extortion Campaigns
Identity Theft Risk: ['High (Due to Potential Exposure of Sensitive Data)']
Incident : data breach ORA1385213111725
Identity Theft Risk: True
Incident : Ransomware ORA4332743112125
Data Compromised: Financial records, Personal records, Erp data
Systems Affected: Oracle E-Business Suite (Versions 12.2.3–12.2.14)Internal Corporate Systems
Operational Impact: Potential disruption to order management, procurement, and logistics functions
Brand Reputation Impact: High (public listing on dark web leak site)
Identity Theft Risk: High (personal records exposed)
Incident : Ransomware Attack ORA5233252112125
Data Compromised: Internal corporate data, Customer information, Financial records, Personal data
Systems Affected: Oracle E-Business Suite (EBS) ServersEnterprise Resource Planning (ERP) Systems
Operational Impact: Potential disruption to order management, procurement, and logistics
Brand Reputation Impact: High (public listing on dark web leak site)
Identity Theft Risk: ['High (PII exposure risk)']
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Credit Card Payment Information, , Payment Card Data, , Sso Passwords, Java Keystore Files, Key Files, Jps Keys, , Jks Files, Encrypted Sso Passwords, Key Files, Jps Keys, , Electronic Health Records (Ehr), , Sso Credentials, Ldap Passwords, Oauth2 Keys, , Sensitive Customer Data, , Personal Information, Usernames, Email Addresses, Hashed Passwords, Sso Credentials, Ldap Credentials, Jks Files, Enterprise Manager Jps Keys, , User Emails, Hashed Passwords, Usernames, , Personally Identifiable Information (Pii), , Credentials (Usernames, Passwords), Pii (Email Addresses, Phone Numbers), Guest Data, Payment Information, Booking Details, , Potentially Finance, Hr, Supply Chain Data, Client Credentials (From January Incident), , Customer Data, Employee Information, Human Resources Files, , Personal Information (Executives), Customer Data, Employee Hr Files, , Sensitive Corporate Documents, Potentially Pii, , Personally Identifiable Information (Pii) Of Executives, Customer Data, Employee Hr Files, Corporate Sensitive Data, , Patient Personal Data, Potentially Sensitive Healthcare Information, , Sensitive Resources, Potentially Oracle Ebs Data (As Per Extortion Claims), , Employee Data, Contractor Data, , Financial Records, Personal Records, Erp Data, , Corporate Internal Data, Customer Information, Financial Records, Personal Data and .
Which entities were affected by each incident ?
Incident : Malware Infection MIC1953291023
Entity Name: Oracle
Entity Type: IT Company
Industry: Technology
Incident : Data Breach ORA615032225
Entity Name: Oracle Cloud
Entity Type: Cloud Service Provider
Industry: Technology
Customers Affected: 140,000 tenants
Incident : Data Breach ORA526032825
Entity Name: Oracle Health
Entity Type: Healthcare Technology Company
Industry: Healthcare
Location: United States
Customers Affected: Multiple US healthcare organizations and hospitals
Incident : Data Breach ORA805033125
Entity Name: Oracle Cloud
Entity Type: Cloud Service Provider
Industry: Technology
Incident : Data Breach ORA455040125
Entity Name: Oracle Health
Entity Type: Company
Industry: Healthcare
Incident : Data Breach ORA956040325
Entity Name: Oracle Corporation
Entity Type: Corporation
Industry: Technology
Incident : Data Breach ORA720082025
Entity Name: Fidelity Investments
Entity Type: Financial Services
Industry: Investment Management
Location: United States
Incident : Data Breach ORA720082025
Entity Name: Oracle Corporation
Entity Type: Corporation
Industry: Technology
Location: United States
Customers Affected: Unknown (employees affected)
Incident : phishing ORA805090225
Entity Name: Oracle Hospitality
Entity Type: technology provider
Industry: hospitality
Location: global
Size: large enterprise
Incident : phishing ORA805090225
Entity Name: Airbnb
Entity Type: vacation rental platform
Industry: hospitality
Location: global
Size: large enterprise
Incident : phishing ORA805090225
Entity Name: Unnamed hotel and vacation rental providers (11+ others)
Entity Type: hotel chains, property management companies, vacation rental services
Industry: hospitality
Location: global
Incident : Extortion ORA4062140100225
Entity Type: Multiple Companies (Executives Targeted)
Incident : Data Breach ORA1092210100225
Entity Name: Oracle (Primary Target)
Entity Type: Corporation
Industry: Technology/Enterprise Software
Location: Global (HQ: Redwood Shores, California, USA)
Size: Large (Fortune 100)
Customers Affected: Numerous Organizations (Exact Number Undisclosed)
Incident : ransomware ORA0193001100225
Entity Name: Oracle (via Oracle E-Business Suite)
Entity Type: software vendor
Industry: technology
Location: global
Size: large (thousands of organizations use Oracle E-Business Suite)
Customers Affected: numerous large organizations (exact number unspecified)
Incident : Data Breach ORA5662156100625
Entity Name: Oracle Corporation
Entity Type: Technology Vendor
Industry: Enterprise Software
Location: Global (HQ: Redwood City, California, USA)
Size: Large (Multinational)
Customers Affected: Multiple (exact number undisclosed)
Incident : extortion ORA2192321100625
Entity Name: Oracle E-Business Suite (EBS) customers
Entity Type: enterprise organizations
Industry: multiple industries (finance, supply chain, CRM-dependent sectors)
Size: ['large organizations']
Incident : Data Breach ORA4993249100625
Entity Name: Oracle Corporation
Entity Type: Technology Company
Industry: Enterprise Software
Location: Global (HQ: Redwood Shores, California, USA)
Size: Large (thousands of organizations use Oracle E-Business Suite)
Customers Affected: Multiple (exact number unspecified, includes corporate executives)
Incident : Data Theft ORA1692116100725
Entity Name: Multiple Organizations Using Oracle E-Business Suite
Entity Type: Corporations, Enterprises
Location: Global (targeting internet-exposed EBS applications)
Incident : Data Breach ORA4202442101025
Entity Name: Oracle Corporation
Entity Type: Software Vendor
Industry: Technology
Location: Redwood City, California, USA
Size: Large Enterprise
Customers Affected: Dozens of Organizations (Exact Number Undisclosed)
Incident : Data Theft ORA4092340101025
Entity Name: Hospitals and Health Systems (General)
Entity Type: Healthcare Provider
Industry: Healthcare
Location: United States (Nationwide)
Incident : Data Theft ORA4092340101025
Entity Name: Rural Hospitals (Including Critical Access Hospitals and Rural Emergency Hospitals)
Entity Type: Healthcare Provider
Industry: Healthcare
Location: United States (Rural Areas)
Size: Small to Medium
Incident : Vulnerability Exploitation ORA0832608101425
Entity Name: Oracle Corporation
Entity Type: Software Vendor
Industry: Technology
Location: Global (HQ: Redwood City, California, USA)
Size: Large Enterprise
Customers Affected: Multiple (Exact Number Unspecified)
Incident : Vulnerability Exploitation ORA0832608101425
Entity Name: Unspecified Organizations Using Oracle E-Business Suite
Entity Type: Enterprises, Government Agencies, Potential High-Value Targets
Location: Global
Incident : data breach ORA1385213111725
Entity Name: The Washington Post
Entity Type: media organization
Industry: news/publishing
Location: United States
Incident : Ransomware ORA4332743112125
Entity Name: Oracle Corporation
Entity Type: Technology Vendor
Industry: Enterprise Software
Location: United States
Size: Large (Multinational)
Incident : Ransomware ORA4332743112125
Entity Name: MAZDA.COM
Entity Type: Corporate
Industry: Automotive
Incident : Ransomware ORA4332743112125
Entity Name: HUMANA.COM
Entity Type: Corporate
Industry: Healthcare Insurance
Incident : Ransomware ORA4332743112125
Entity Name: Washington Post
Entity Type: Media
Industry: News/Publishing
Incident : Ransomware Attack ORA5233252112125
Entity Name: Oracle Corporation
Entity Type: Technology Vendor
Industry: Enterprise Software
Location: Global (HQ: Redwood City, California, USA)
Size: Large (Multinational)
Customers Affected: Potentially high (internal systems + customers using EBS)
Incident : Ransomware Attack ORA5233252112125
Entity Name: Mazda
Entity Type: Corporation
Industry: Automotive
Location: Global
Incident : Ransomware Attack ORA5233252112125
Entity Name: Humana
Entity Type: Corporation
Industry: Healthcare Insurance
Location: USA
Incident : Ransomware Attack ORA5233252112125
Entity Name: The Washington Post
Entity Type: Media Organization
Industry: News/Publishing
Location: USA
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Data Breach ORA392622
Containment Measures: Password Change Recommendation
Communication Strategy: Customer Advisory
Incident : Malware Infection MIC1953291023
Containment Measures: Password Reset
Remediation Measures: Malware Removal
Communication Strategy: Letter to Users
Incident : Data Breach ORA526032825
Communication Strategy: Criticized for lack of transparency
Incident : Data Breach ORA805033125
Third Party Assistance: Cloudsek, Trustwave Spiderlabs.
Incident : Data Breach ORA455040125
Communication Strategy: Private letters to customers
Incident : Data Breach ORA656040225
Communication Strategy: Outright DenialPotentially Misleading StatementsAccusations of Deleting Evidence Online
Incident : Data Breach ORA956040325
Remediation Measures: Informed clientsBolstered Gen 1 server security
Incident : Data Breach ORA720082025
Law Enforcement Notified: Yes (California Office of the Attorney General)
Incident : phishing ORA805090225
Third Party Assistance: Okta Threat Intelligence (Analysis By Moussa Diallo).
Containment Measures: monitoring for suspicious domain registrationsblocking known malicious domains
Remediation Measures: implementation of phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn)adaptive risk assessments for unusual access patterns
Communication Strategy: customer advisories about impersonation attemptsindustry-wide alerts
Enhanced Monitoring: real-time tracking of typosquatted domainsbeaconing detection
Incident : Extortion ORA4062140100225
Incident Response Plan Activated: Recommended (investigate Oracle E-Business Suite environments)
Third Party Assistance: Mandiant (Google Cloud), Gtig.
Enhanced Monitoring: Recommended (for unusual access)
Incident : Data Breach ORA1092210100225
Incident Response Plan Activated: True
Third Party Assistance: Mandiant (Google Cloud), Google Threat Intelligence Group (Gtig).
Communication Strategy: Public Warning via Cybersecurity Firms (Mandiant, GTIG)Media Outreach (Recorded Future News)
Incident : ransomware ORA0193001100225
Incident Response Plan Activated: yes (by affected organizations and firms like Halcyon and Mandiant)
Third Party Assistance: Mandiant (Google’S Incident Response Unit), Halcyon (Counter-Ransomware Firm).
Communication Strategy: public disclosure via media (TechCrunch, Bloomberg); anonymous reporting channel for affected executives
Incident : Data Breach ORA5662156100625
Incident Response Plan Activated: True
Third Party Assistance: Mandiant (Google Cloud).
Containment Measures: Emergency Patch Release (CVE-2025-61882)Advisory for Customer Mitigation
Remediation Measures: Patch ApplicationInvestigation into Potential Prior Compromise
Communication Strategy: Public AdvisoryLinkedIn Post by Oracle CSOMandiant Technical Alert
Enhanced Monitoring: Recommended for customers to detect prior compromise
Incident : extortion ORA2192321100625
Incident Response Plan Activated: ['recommended: ERP-compromise tabletop exercises within 24–48 hours']
Law Enforcement Notified: recommended: preserve email headers/artifacts for law enforcement or threat intelligence,
Containment Measures: patch verification (July 2025 CPU)rotate SSO tokensenforce MFA on EBS admin/service accountsreview privileged roles and recent admin logins for anomalies
Remediation Measures: inventory and re-authorize third-party integrations (APIs, connectors, file transfers)monitor interface logs for unusual spikes/failures
Communication Strategy: route extortion emails via security and legal channelspre-draft customer and regulator communications
Enhanced Monitoring: monitor ERP integration points for anomalies
Incident : Data Breach ORA4993249100625
Incident Response Plan Activated: Yes (Oracle released patch and urged immediate installation)
Third Party Assistance: Google Mandiant (Investigation And Advisory).
Containment Measures: Patch release (CVE-2025-61882)Indicators of Compromise (IoCs) shared with customers
Remediation Measures: Urgent patch installation recommended for all customers
Communication Strategy: Public security advisory by Oracle CSO Rob DuhartLinkedIn post by Google Mandiant CTO Charles Carmakal
Incident : Data Theft ORA1692116100725
Incident Response Plan Activated: ['Oracle Security Alert (Urgent Patching Advisory)']
Third Party Assistance: Crowdstrike (Detection And Analysis), Mandiant (Investigation), Google Threat Intelligence Group (Gtig).
Containment Measures: Patching CVE-2025-61882Disabling Exposed EBS Components
Communication Strategy: Oracle Customer AdvisoryPublic Disclosure of PoC Risks
Enhanced Monitoring: Recommended for Oracle EBS Environments
Incident : Data Breach ORA4202442101025
Incident Response Plan Activated: Yes (Google and Oracle)
Third Party Assistance: Google Security Researchers.
Remediation Measures: Oracle Security Advisory IssuedTechnical Indicators Shared by Google for Detection
Communication Strategy: Public Advisory by OracleBlog Post by GoogleMedia Statements
Enhanced Monitoring: Recommended (Google Provided Indicators for Detection)
Incident : Data Theft ORA4092340101025
Third Party Assistance: Aha’S Preferred Cybersecurity Provider Program, Microsoft (Via Rural Health Resiliency Program).
Containment Measures: Immediate Software Patch Installation (Oracle’s E-Business Suite)Long-Term Cyber Incident Response Planning
Remediation Measures: Cybersecurity AssessmentsCloud Capability EvaluationsCurated Cyber and AI TrainingFoundational Cyber Certifications for IT Staff
Communication Strategy: AHA Advisories with Federal Law Enforcement InputPublic Awareness Campaigns (e.g., Cybersecurity Awareness Month)
Incident : Vulnerability Exploitation ORA0832608101425
Incident Response Plan Activated: Yes (Oracle Released Emergency Security Alerts and Patches)
Third Party Assistance: Google Threat Intelligence, Mandiant, Crowdstrike.
Containment Measures: Emergency Patching (CVE-2025-61884 & CVE-2025-61882)Urgent Advisory for Customers to Apply Updates
Remediation Measures: Patch DeploymentMitigation Guidance for Unpatched Systems
Communication Strategy: Public Security AdvisoriesDirect Customer Notifications
Enhanced Monitoring: Recommended (Oracle Advised Customers to Monitor for Exploitation Attempts)
Incident : Ransomware ORA4332743112125
Remediation Measures: Patch released in October 2025 Security Alert
Incident : Ransomware Attack ORA5233252112125
Third Party Assistance: Security Researchers (The Raven File).
Remediation Measures: Oracle released patch in October 2025
What is the company's incident response plan?
Incident Response Plan: The company's incident response plan is described as Recommended (investigate Oracle E-Business Suite environments), , , , recommended: ERP-compromise tabletop exercises within 24–48 hours, , Yes (Oracle released patch and urged immediate installation), Oracle Security Alert (Urgent Patching Advisory), , Yes (Google and Oracle), Yes (Oracle Released Emergency Security Alerts and Patches).
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through CloudSEK, Trustwave SpiderLabs, , Okta Threat Intelligence (analysis by Moussa Diallo), , Mandiant (Google Cloud), GTIG, , Mandiant (Google Cloud), Google Threat Intelligence Group (GTIG), , Mandiant (Google’s incident response unit), Halcyon (counter-ransomware firm), , Mandiant (Google Cloud), , Google Mandiant (investigation and advisory), , CrowdStrike (Detection and Analysis), Mandiant (Investigation), Google Threat Intelligence Group (GTIG), , Google Security Researchers, , AHA’s Preferred Cybersecurity Provider Program, Microsoft (via Rural Health Resiliency Program), , Google Threat Intelligence, Mandiant, CrowdStrike, , Security researchers (THE RAVEN FILE), .
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach ORA392622
Type of Data Compromised: Credit card payment information
Sensitivity of Data: High
Incident : Malware Infection MIC1953291023
Type of Data Compromised: Payment card data
Sensitivity of Data: High
Data Encryption: ['Yes']
Incident : Data Breach ORA344032125
Type of Data Compromised: Sso passwords, Java keystore files, Key files, Jps keys
Number of Records Exposed: 6 million
Sensitivity of Data: High
Data Encryption: Encrypted and hashed passwords
Incident : Data Breach ORA615032225
Type of Data Compromised: Jks files, Encrypted sso passwords, Key files, Jps keys
Number of Records Exposed: 6 million
Sensitivity of Data: High
Data Exfiltration: Yes
Data Encryption: Yes
File Types Exposed: JKS filesSSO passwordsKey filesJPS keys
Incident : Data Breach ORA526032825
Type of Data Compromised: Electronic health records (ehr)
Data Exfiltration: Electronic Health Records (EHR)
Incident : Data Breach ORA805033125
Type of Data Compromised: Sso credentials, Ldap passwords, Oauth2 keys
Number of Records Exposed: 6000000
Sensitivity of Data: High
Incident : Data Breach ORA455040125
Type of Data Compromised: Sensitive customer data
Sensitivity of Data: High
Incident : Data Breach ORA656040225
Type of Data Compromised: Personal Information
Incident : Data Breach ORA956040325
Type of Data Compromised: Usernames, Email addresses, Hashed passwords, Sso credentials, Ldap credentials, Jks files, Enterprise manager jps keys
Number of Records Exposed: 6 million
Sensitivity of Data: High
File Types Exposed: JKS filesJPS keys
Incident : Data Breach ORA1045040925
Type of Data Compromised: User emails, Hashed passwords, Usernames
Incident : Data Breach ORA720082025
Type of Data Compromised: Personally identifiable information (pii)
Number of Records Exposed: Unknown
Sensitivity of Data: High
Data Exfiltration: Yes (report accessed)
Personally Identifiable Information: NamesSocial Security Numbers
Incident : phishing ORA805090225
Type of Data Compromised: Credentials (usernames, passwords), Pii (email addresses, phone numbers), Guest data, Payment information, Booking details
Sensitivity of Data: high (financial and personal identifiable information)
Data Exfiltration: likely (credentials sold on dark web)
Personally Identifiable Information: namesemail addressesphone numberspotential payment card data
Incident : Extortion ORA4062140100225
Data Exfiltration: Claimed (unsubstantiated)
Incident : Data Breach ORA1092210100225
Type of Data Compromised: Potentially finance, hr, supply chain data, Client credentials (from january incident)
Sensitivity of Data: High (Enterprise-Critical and Potentially PII)
Data Exfiltration: Claimed by Threat Actor (Unverified)
Personally Identifiable Information: Potential (If HR Data Compromised)
Incident : ransomware ORA0193001100225
Type of Data Compromised: Customer data, Employee information, Human resources files
Number of Records Exposed: tens of millions (estimated)
Sensitivity of Data: high (includes PII and corporate HR data)
Data Exfiltration: claimed by threat actor
Personally Identifiable Information: yes
Incident : Data Breach ORA5662156100625
Incident : extortion ORA2192321100625
Data Exfiltration: unverified claims by threat actors
Incident : Data Breach ORA4993249100625
Type of Data Compromised: Personal information (executives), Customer data, Employee hr files
Sensitivity of Data: High (personal and corporate-sensitive data)
Data Exfiltration: Yes (evidenced by extortion emails)
Personally Identifiable Information: Yes (executives' personal data)
Incident : Data Theft ORA1692116100725
Type of Data Compromised: Sensitive corporate documents, Potentially pii
Sensitivity of Data: High (confidential business documents)
Data Exfiltration: Confirmed (by Clop for extortion)
Personally Identifiable Information: Possible (not explicitly confirmed)
Incident : Data Breach ORA4202442101025
Type of Data Compromised: Personally identifiable information (pii) of executives, Customer data, Employee hr files, Corporate sensitive data
Sensitivity of Data: High
Data Exfiltration: Confirmed
Personally Identifiable Information: Yes (Executives and Employees)
Incident : Data Theft ORA4092340101025
Type of Data Compromised: Patient personal data, Potentially sensitive healthcare information
Sensitivity of Data: High (Includes Personally Identifiable Information and Healthcare Records)
Data Encryption: True
Incident : Vulnerability Exploitation ORA0832608101425
Type of Data Compromised: Sensitive resources, Potentially oracle ebs data (as per extortion claims)
Sensitivity of Data: High (Potential Access to Confidential Business Data)
Data Exfiltration: Claimed in Extortion Emails (Unverified)
Incident : data breach ORA1385213111725
Type of Data Compromised: Employee data, Contractor data
Number of Records Exposed: 9720
Sensitivity of Data: high (personally identifiable information)
Incident : Ransomware ORA4332743112125
Type of Data Compromised: Financial records, Personal records, Erp data
Sensitivity of Data: High
Data Exfiltration: Confirmed (threatened release on dark web)
Personally Identifiable Information: Yes
Incident : Ransomware Attack ORA5233252112125
Type of Data Compromised: Corporate internal data, Customer information, Financial records, Personal data
Sensitivity of Data: High
Data Exfiltration: Claimed by Clop (evidenced by dark web leak site listing)
Personally Identifiable Information: Likely (based on extortion threats)
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Malware Removal, , Informed clients, Bolstered Gen 1 server security, , implementation of phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn), adaptive risk assessments for unusual access patterns, , Patch Application, Investigation into Potential Prior Compromise, , inventory and re-authorize third-party integrations (APIs, connectors, file transfers), monitor interface logs for unusual spikes/failures, , Urgent patch installation recommended for all customers, , Oracle Security Advisory Issued, Technical Indicators Shared by Google for Detection, , Cybersecurity Assessments, Cloud Capability Evaluations, Curated Cyber and AI Training, Foundational Cyber Certifications for IT Staff, , Patch Deployment, Mitigation Guidance for Unpatched Systems, , Patch released in October 2025 Security Alert, , Oracle released patch in October 2025, .
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by password change recommendation, , password reset, , monitoring for suspicious domain registrations, blocking known malicious domains, , emergency patch release (cve-2025-61882), advisory for customer mitigation, , patch verification (july 2025 cpu), rotate sso tokens, enforce mfa on ebs admin/service accounts, review privileged roles and recent admin logins for anomalies, , patch release (cve-2025-61882), indicators of compromise (iocs) shared with customers, , patching cve-2025-61882, disabling exposed ebs components, , immediate software patch installation (oracle’s e-business suite), long-term cyber incident response planning, , emergency patching (cve-2025-61884 & cve-2025-61882), urgent advisory for customers to apply updates and .
Ransomware Information
Was ransomware involved in any of the incidents ?
Incident : Extortion ORA4062140100225
Ransomware Strain: Clop (potential link)
Data Exfiltration: Claimed (unsubstantiated)
Incident : Data Breach ORA1092210100225
Ransomware Strain: Clop (Claimed Affiliation)
Data Exfiltration: Claimed (Unverified)
Incident : ransomware ORA0193001100225
Ransom Demanded: $50 million (in at least one case)
Ransomware Strain: Clop
Data Exfiltration: claimed by threat actor
Incident : extortion ORA2192321100625
Data Exfiltration: ['unverified claims']
Incident : Data Breach ORA4993249100625
Ransom Demanded: Yes (extortion emails sent to executives)
Data Exfiltration: Yes
Incident : Data Theft ORA1692116100725
Ransom Demanded: ['Undisclosed (extortion emails sent to executives)']
Ransomware Strain: Clop
Data Encryption: ['No (data theft-only campaign)']
Data Exfiltration: ['Yes']
Incident : Vulnerability Exploitation ORA0832608101425
Ransom Demanded: Extortion Emails Sent (Amount Unspecified)
Ransomware Strain: Cl0p
Data Exfiltration: Claimed (Unverified)
Incident : Ransomware Attack ORA5233252112125
Ransomware Strain: Clop
Data Exfiltration: Confirmed (threatened public release)
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Data Breach ORA526032825
Regulations Violated: HIPAA,
Incident : Data Breach ORA720082025
Regulatory Notifications: California Office of the Attorney General
Incident : Data Breach ORA1092210100225
Regulatory Notifications: CISA Warning (January Incident, Potentially Linked)
Incident : extortion ORA2192321100625
Regulatory Notifications: recommended: pre-draft regulator communications
Incident : Data Theft ORA1692116100725
Regulatory Notifications: Oracle Customer Advisory (non-regulatory)
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : Data Breach ORA1045040925
Lessons Learned: The event underscores the risks of maintaining outdated systems and the importance of clear communication in the face of cybersecurity incidents.
Incident : phishing ORA805090225
Lessons Learned: Malvertising is an effective initial access vector for targeted phishing campaigns., MFA bypass techniques (e.g., real-time OTP capture) undermine traditional authentication methods., Typosquatted domains and convincing phishing pages can evade user scrutiny., Russian-speaking threat actors continue to leverage proxy infrastructure for anonymity., Hospitality industry is a high-value target due to sensitive guest data and payment systems.
Incident : Data Breach ORA5662156100625
Lessons Learned: Zero-day vulnerabilities in widely used enterprise software like Oracle E-Business Suite can lead to rapid, high-impact exploitation by multiple threat actors. Organizations must prioritize patch management and assume breach scenarios even after patching, given the likelihood of prior compromise during mass exploitation campaigns.
Incident : extortion ORA2192321100625
Lessons Learned: Proactive patching and hardening of ERP systems are critical to mitigating extortion risks., Executive-targeted extortion emails require coordinated legal and security responses., Third-party integrations in ERP systems are high-risk vectors and require strict monitoring., Tabletop exercises help identify procedural gaps before real incidents occur.
Incident : Data Theft ORA1692116100725
Lessons Learned: Zero-day vulnerabilities in enterprise software like Oracle EBS are high-value targets for ransomware groups., Public PoC disclosures accelerate exploitation by multiple threat actors., Proactive patching and exposure management are critical for mitigating RCE risks.
Incident : Data Breach ORA4202442101025
Lessons Learned: Zero-day vulnerabilities in widely used enterprise software can lead to large-scale data breaches. Proactive patch management and monitoring for unusual network activity are critical. Vendors must ensure transparent communication during ongoing incidents to avoid misinformation.
Incident : Data Theft ORA4092340101025
Lessons Learned: The incident underscores the critical need for timely patch management, robust cybersecurity defenses, and collaboration between healthcare providers, government agencies, and private-sector partners. Under-resourced organizations, such as rural hospitals, require additional support to mitigate cyber risks effectively. A proactive, whole-of-government approach—including offensive cyber capabilities and threat intelligence sharing—is essential to disrupt adversaries before attacks occur.
Incident : Vulnerability Exploitation ORA0832608101425
Lessons Learned: Critical Importance of Timely Patching for Public-Facing Applications, Risks of Zero-Day Exploitation in Enterprise Software, Need for Enhanced Monitoring of Oracle EBS Instances, Potential for Mass Extortion Campaigns Leveraging Stolen Credentials
What recommendations were made to prevent future incidents ?
Incident : Data Breach ORA392622
Recommendations: Change Passwords, Enhance Security MeasuresChange Passwords, Enhance Security Measures
Incident : phishing ORA805090225
Recommendations: Adopt phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn)., Implement adaptive risk assessments to detect anomalous access patterns., Monitor for suspicious domain registrations (e.g., typosquatting)., Educate employees and customers about malvertising and phishing risks., Deploy behavioral analytics to detect beaconing and tracking scripts., Restrict access to property management systems with zero-trust principles., Collaborate with threat intelligence providers (e.g., Okta) for IOCs.Adopt phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn)., Implement adaptive risk assessments to detect anomalous access patterns., Monitor for suspicious domain registrations (e.g., typosquatting)., Educate employees and customers about malvertising and phishing risks., Deploy behavioral analytics to detect beaconing and tracking scripts., Restrict access to property management systems with zero-trust principles., Collaborate with threat intelligence providers (e.g., Okta) for IOCs.Adopt phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn)., Implement adaptive risk assessments to detect anomalous access patterns., Monitor for suspicious domain registrations (e.g., typosquatting)., Educate employees and customers about malvertising and phishing risks., Deploy behavioral analytics to detect beaconing and tracking scripts., Restrict access to property management systems with zero-trust principles., Collaborate with threat intelligence providers (e.g., Okta) for IOCs.Adopt phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn)., Implement adaptive risk assessments to detect anomalous access patterns., Monitor for suspicious domain registrations (e.g., typosquatting)., Educate employees and customers about malvertising and phishing risks., Deploy behavioral analytics to detect beaconing and tracking scripts., Restrict access to property management systems with zero-trust principles., Collaborate with threat intelligence providers (e.g., Okta) for IOCs.Adopt phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn)., Implement adaptive risk assessments to detect anomalous access patterns., Monitor for suspicious domain registrations (e.g., typosquatting)., Educate employees and customers about malvertising and phishing risks., Deploy behavioral analytics to detect beaconing and tracking scripts., Restrict access to property management systems with zero-trust principles., Collaborate with threat intelligence providers (e.g., Okta) for IOCs.Adopt phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn)., Implement adaptive risk assessments to detect anomalous access patterns., Monitor for suspicious domain registrations (e.g., typosquatting)., Educate employees and customers about malvertising and phishing risks., Deploy behavioral analytics to detect beaconing and tracking scripts., Restrict access to property management systems with zero-trust principles., Collaborate with threat intelligence providers (e.g., Okta) for IOCs.Adopt phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn)., Implement adaptive risk assessments to detect anomalous access patterns., Monitor for suspicious domain registrations (e.g., typosquatting)., Educate employees and customers about malvertising and phishing risks., Deploy behavioral analytics to detect beaconing and tracking scripts., Restrict access to property management systems with zero-trust principles., Collaborate with threat intelligence providers (e.g., Okta) for IOCs.
Incident : Extortion ORA4062140100225
Recommendations: Investigate Oracle E-Business Suite environments for unusual access or compromise, Monitor for high-volume extortion email campaigns from compromised accounts, Assess potential links to FIN11/Clop ransomware activityInvestigate Oracle E-Business Suite environments for unusual access or compromise, Monitor for high-volume extortion email campaigns from compromised accounts, Assess potential links to FIN11/Clop ransomware activityInvestigate Oracle E-Business Suite environments for unusual access or compromise, Monitor for high-volume extortion email campaigns from compromised accounts, Assess potential links to FIN11/Clop ransomware activity
Incident : Data Breach ORA5662156100625
Recommendations: Immediately apply Oracle's emergency patch for CVE-2025-61882., Conduct forensic investigations to detect signs of prior exploitation., Monitor for IoCs, including the listed IP addresses (200.107.207[.]26, 185.181.60[.]11) and exploit artifacts., Enhance logging and network segmentation for Oracle EBS environments., Review Mandiant's advisory for additional mitigation strategies.Immediately apply Oracle's emergency patch for CVE-2025-61882., Conduct forensic investigations to detect signs of prior exploitation., Monitor for IoCs, including the listed IP addresses (200.107.207[.]26, 185.181.60[.]11) and exploit artifacts., Enhance logging and network segmentation for Oracle EBS environments., Review Mandiant's advisory for additional mitigation strategies.Immediately apply Oracle's emergency patch for CVE-2025-61882., Conduct forensic investigations to detect signs of prior exploitation., Monitor for IoCs, including the listed IP addresses (200.107.207[.]26, 185.181.60[.]11) and exploit artifacts., Enhance logging and network segmentation for Oracle EBS environments., Review Mandiant's advisory for additional mitigation strategies.Immediately apply Oracle's emergency patch for CVE-2025-61882., Conduct forensic investigations to detect signs of prior exploitation., Monitor for IoCs, including the listed IP addresses (200.107.207[.]26, 185.181.60[.]11) and exploit artifacts., Enhance logging and network segmentation for Oracle EBS environments., Review Mandiant's advisory for additional mitigation strategies.Immediately apply Oracle's emergency patch for CVE-2025-61882., Conduct forensic investigations to detect signs of prior exploitation., Monitor for IoCs, including the listed IP addresses (200.107.207[.]26, 185.181.60[.]11) and exploit artifacts., Enhance logging and network segmentation for Oracle EBS environments., Review Mandiant's advisory for additional mitigation strategies.
Incident : extortion ORA2192321100625
Recommendations: Apply the July 2025 Oracle Critical Patch Update immediately., Enforce MFA and rotate credentials for EBS admin/service accounts., Conduct a thorough review of privileged roles and recent logins., Inventory and re-authorize all third-party integrations with EBS., Preserve extortion email artifacts for forensic analysis., Run ERP-compromise tabletop exercises to test response readiness., Monitor integration logs for anomalies or unauthorized access attempts.Apply the July 2025 Oracle Critical Patch Update immediately., Enforce MFA and rotate credentials for EBS admin/service accounts., Conduct a thorough review of privileged roles and recent logins., Inventory and re-authorize all third-party integrations with EBS., Preserve extortion email artifacts for forensic analysis., Run ERP-compromise tabletop exercises to test response readiness., Monitor integration logs for anomalies or unauthorized access attempts.Apply the July 2025 Oracle Critical Patch Update immediately., Enforce MFA and rotate credentials for EBS admin/service accounts., Conduct a thorough review of privileged roles and recent logins., Inventory and re-authorize all third-party integrations with EBS., Preserve extortion email artifacts for forensic analysis., Run ERP-compromise tabletop exercises to test response readiness., Monitor integration logs for anomalies or unauthorized access attempts.Apply the July 2025 Oracle Critical Patch Update immediately., Enforce MFA and rotate credentials for EBS admin/service accounts., Conduct a thorough review of privileged roles and recent logins., Inventory and re-authorize all third-party integrations with EBS., Preserve extortion email artifacts for forensic analysis., Run ERP-compromise tabletop exercises to test response readiness., Monitor integration logs for anomalies or unauthorized access attempts.Apply the July 2025 Oracle Critical Patch Update immediately., Enforce MFA and rotate credentials for EBS admin/service accounts., Conduct a thorough review of privileged roles and recent logins., Inventory and re-authorize all third-party integrations with EBS., Preserve extortion email artifacts for forensic analysis., Run ERP-compromise tabletop exercises to test response readiness., Monitor integration logs for anomalies or unauthorized access attempts.Apply the July 2025 Oracle Critical Patch Update immediately., Enforce MFA and rotate credentials for EBS admin/service accounts., Conduct a thorough review of privileged roles and recent logins., Inventory and re-authorize all third-party integrations with EBS., Preserve extortion email artifacts for forensic analysis., Run ERP-compromise tabletop exercises to test response readiness., Monitor integration logs for anomalies or unauthorized access attempts.Apply the July 2025 Oracle Critical Patch Update immediately., Enforce MFA and rotate credentials for EBS admin/service accounts., Conduct a thorough review of privileged roles and recent logins., Inventory and re-authorize all third-party integrations with EBS., Preserve extortion email artifacts for forensic analysis., Run ERP-compromise tabletop exercises to test response readiness., Monitor integration logs for anomalies or unauthorized access attempts.
Incident : Data Breach ORA4993249100625
Recommendations: Install Oracle's patch for CVE-2025-61882 immediately, Monitor systems for Indicators of Compromise (IoCs) provided by Oracle, Enhance security for executive personal data, Review third-party vulnerability disclosures for proactive patchingInstall Oracle's patch for CVE-2025-61882 immediately, Monitor systems for Indicators of Compromise (IoCs) provided by Oracle, Enhance security for executive personal data, Review third-party vulnerability disclosures for proactive patchingInstall Oracle's patch for CVE-2025-61882 immediately, Monitor systems for Indicators of Compromise (IoCs) provided by Oracle, Enhance security for executive personal data, Review third-party vulnerability disclosures for proactive patchingInstall Oracle's patch for CVE-2025-61882 immediately, Monitor systems for Indicators of Compromise (IoCs) provided by Oracle, Enhance security for executive personal data, Review third-party vulnerability disclosures for proactive patching
Incident : Data Theft ORA1692116100725
Recommendations: Immediately patch CVE-2025-61882 in Oracle E-Business Suite environments., Restrict internet exposure of EBS applications and enforce authentication controls., Monitor for signs of data exfiltration, especially via BI Publisher components., Prepare for extortion attempts if using Oracle EBS, given Clop’s history of targeting such vulnerabilities., Engage threat intelligence services (e.g., CrowdStrike, Mandiant) for proactive detection.Immediately patch CVE-2025-61882 in Oracle E-Business Suite environments., Restrict internet exposure of EBS applications and enforce authentication controls., Monitor for signs of data exfiltration, especially via BI Publisher components., Prepare for extortion attempts if using Oracle EBS, given Clop’s history of targeting such vulnerabilities., Engage threat intelligence services (e.g., CrowdStrike, Mandiant) for proactive detection.Immediately patch CVE-2025-61882 in Oracle E-Business Suite environments., Restrict internet exposure of EBS applications and enforce authentication controls., Monitor for signs of data exfiltration, especially via BI Publisher components., Prepare for extortion attempts if using Oracle EBS, given Clop’s history of targeting such vulnerabilities., Engage threat intelligence services (e.g., CrowdStrike, Mandiant) for proactive detection.Immediately patch CVE-2025-61882 in Oracle E-Business Suite environments., Restrict internet exposure of EBS applications and enforce authentication controls., Monitor for signs of data exfiltration, especially via BI Publisher components., Prepare for extortion attempts if using Oracle EBS, given Clop’s history of targeting such vulnerabilities., Engage threat intelligence services (e.g., CrowdStrike, Mandiant) for proactive detection.Immediately patch CVE-2025-61882 in Oracle E-Business Suite environments., Restrict internet exposure of EBS applications and enforce authentication controls., Monitor for signs of data exfiltration, especially via BI Publisher components., Prepare for extortion attempts if using Oracle EBS, given Clop’s history of targeting such vulnerabilities., Engage threat intelligence services (e.g., CrowdStrike, Mandiant) for proactive detection.
Incident : Data Breach ORA4202442101025
Recommendations: Immediately patch Oracle E-Business Suite to the latest version., Monitor networks for indicators of compromise (IoCs) provided by Google., Implement multi-factor authentication (MFA) for all critical systems., Conduct regular security audits for enterprise software., Educate employees about phishing and extortion email tactics.Immediately patch Oracle E-Business Suite to the latest version., Monitor networks for indicators of compromise (IoCs) provided by Google., Implement multi-factor authentication (MFA) for all critical systems., Conduct regular security audits for enterprise software., Educate employees about phishing and extortion email tactics.Immediately patch Oracle E-Business Suite to the latest version., Monitor networks for indicators of compromise (IoCs) provided by Google., Implement multi-factor authentication (MFA) for all critical systems., Conduct regular security audits for enterprise software., Educate employees about phishing and extortion email tactics.Immediately patch Oracle E-Business Suite to the latest version., Monitor networks for indicators of compromise (IoCs) provided by Google., Implement multi-factor authentication (MFA) for all critical systems., Conduct regular security audits for enterprise software., Educate employees about phishing and extortion email tactics.Immediately patch Oracle E-Business Suite to the latest version., Monitor networks for indicators of compromise (IoCs) provided by Google., Implement multi-factor authentication (MFA) for all critical systems., Conduct regular security audits for enterprise software., Educate employees about phishing and extortion email tactics.
Incident : Data Theft ORA4092340101025
Recommendations: Install Immediate Patches for Oracle’s E-Business Suite and Other Critical Systems, Develop and Maintain a Comprehensive Cyber Incident Response Plan, Plan for Clinical Continuity During Cyber Disruptions, Leverage AHA’s Cybersecurity Resources, Including Preferred Provider Programs and Advisory Services, Participate in Free or Discounted Cybersecurity Assessments (e.g., Microsoft’s Rural Health Resiliency Program), Invest in Training and Certifications for IT Staff, Particularly in Rural Healthcare Settings, Strengthen Public-Private Partnerships to Share Threat Intelligence and Best Practices, Advocate for Federal and Allied Nation Interventions to Deter Cyber AdversariesInstall Immediate Patches for Oracle’s E-Business Suite and Other Critical Systems, Develop and Maintain a Comprehensive Cyber Incident Response Plan, Plan for Clinical Continuity During Cyber Disruptions, Leverage AHA’s Cybersecurity Resources, Including Preferred Provider Programs and Advisory Services, Participate in Free or Discounted Cybersecurity Assessments (e.g., Microsoft’s Rural Health Resiliency Program), Invest in Training and Certifications for IT Staff, Particularly in Rural Healthcare Settings, Strengthen Public-Private Partnerships to Share Threat Intelligence and Best Practices, Advocate for Federal and Allied Nation Interventions to Deter Cyber AdversariesInstall Immediate Patches for Oracle’s E-Business Suite and Other Critical Systems, Develop and Maintain a Comprehensive Cyber Incident Response Plan, Plan for Clinical Continuity During Cyber Disruptions, Leverage AHA’s Cybersecurity Resources, Including Preferred Provider Programs and Advisory Services, Participate in Free or Discounted Cybersecurity Assessments (e.g., Microsoft’s Rural Health Resiliency Program), Invest in Training and Certifications for IT Staff, Particularly in Rural Healthcare Settings, Strengthen Public-Private Partnerships to Share Threat Intelligence and Best Practices, Advocate for Federal and Allied Nation Interventions to Deter Cyber AdversariesInstall Immediate Patches for Oracle’s E-Business Suite and Other Critical Systems, Develop and Maintain a Comprehensive Cyber Incident Response Plan, Plan for Clinical Continuity During Cyber Disruptions, Leverage AHA’s Cybersecurity Resources, Including Preferred Provider Programs and Advisory Services, Participate in Free or Discounted Cybersecurity Assessments (e.g., Microsoft’s Rural Health Resiliency Program), Invest in Training and Certifications for IT Staff, Particularly in Rural Healthcare Settings, Strengthen Public-Private Partnerships to Share Threat Intelligence and Best Practices, Advocate for Federal and Allied Nation Interventions to Deter Cyber AdversariesInstall Immediate Patches for Oracle’s E-Business Suite and Other Critical Systems, Develop and Maintain a Comprehensive Cyber Incident Response Plan, Plan for Clinical Continuity During Cyber Disruptions, Leverage AHA’s Cybersecurity Resources, Including Preferred Provider Programs and Advisory Services, Participate in Free or Discounted Cybersecurity Assessments (e.g., Microsoft’s Rural Health Resiliency Program), Invest in Training and Certifications for IT Staff, Particularly in Rural Healthcare Settings, Strengthen Public-Private Partnerships to Share Threat Intelligence and Best Practices, Advocate for Federal and Allied Nation Interventions to Deter Cyber AdversariesInstall Immediate Patches for Oracle’s E-Business Suite and Other Critical Systems, Develop and Maintain a Comprehensive Cyber Incident Response Plan, Plan for Clinical Continuity During Cyber Disruptions, Leverage AHA’s Cybersecurity Resources, Including Preferred Provider Programs and Advisory Services, Participate in Free or Discounted Cybersecurity Assessments (e.g., Microsoft’s Rural Health Resiliency Program), Invest in Training and Certifications for IT Staff, Particularly in Rural Healthcare Settings, Strengthen Public-Private Partnerships to Share Threat Intelligence and Best Practices, Advocate for Federal and Allied Nation Interventions to Deter Cyber AdversariesInstall Immediate Patches for Oracle’s E-Business Suite and Other Critical Systems, Develop and Maintain a Comprehensive Cyber Incident Response Plan, Plan for Clinical Continuity During Cyber Disruptions, Leverage AHA’s Cybersecurity Resources, Including Preferred Provider Programs and Advisory Services, Participate in Free or Discounted Cybersecurity Assessments (e.g., Microsoft’s Rural Health Resiliency Program), Invest in Training and Certifications for IT Staff, Particularly in Rural Healthcare Settings, Strengthen Public-Private Partnerships to Share Threat Intelligence and Best Practices, Advocate for Federal and Allied Nation Interventions to Deter Cyber AdversariesInstall Immediate Patches for Oracle’s E-Business Suite and Other Critical Systems, Develop and Maintain a Comprehensive Cyber Incident Response Plan, Plan for Clinical Continuity During Cyber Disruptions, Leverage AHA’s Cybersecurity Resources, Including Preferred Provider Programs and Advisory Services, Participate in Free or Discounted Cybersecurity Assessments (e.g., Microsoft’s Rural Health Resiliency Program), Invest in Training and Certifications for IT Staff, Particularly in Rural Healthcare Settings, Strengthen Public-Private Partnerships to Share Threat Intelligence and Best Practices, Advocate for Federal and Allied Nation Interventions to Deter Cyber Adversaries
Incident : Vulnerability Exploitation ORA0832608101425
Recommendations: Apply Oracle Security Alerts and Critical Patch Updates Immediately, Monitor for Signs of Exploitation (e.g., Unusual Database Activity, Extortion Emails), Implement Multi-Factor Authentication (MFA) for Oracle EBS, Review and Secure Default Password Reset Mechanisms, Segment Networks to Limit Lateral Movement, Engage Third-Party Threat Intelligence for Indicators of Compromise (IOCs)Apply Oracle Security Alerts and Critical Patch Updates Immediately, Monitor for Signs of Exploitation (e.g., Unusual Database Activity, Extortion Emails), Implement Multi-Factor Authentication (MFA) for Oracle EBS, Review and Secure Default Password Reset Mechanisms, Segment Networks to Limit Lateral Movement, Engage Third-Party Threat Intelligence for Indicators of Compromise (IOCs)Apply Oracle Security Alerts and Critical Patch Updates Immediately, Monitor for Signs of Exploitation (e.g., Unusual Database Activity, Extortion Emails), Implement Multi-Factor Authentication (MFA) for Oracle EBS, Review and Secure Default Password Reset Mechanisms, Segment Networks to Limit Lateral Movement, Engage Third-Party Threat Intelligence for Indicators of Compromise (IOCs)Apply Oracle Security Alerts and Critical Patch Updates Immediately, Monitor for Signs of Exploitation (e.g., Unusual Database Activity, Extortion Emails), Implement Multi-Factor Authentication (MFA) for Oracle EBS, Review and Secure Default Password Reset Mechanisms, Segment Networks to Limit Lateral Movement, Engage Third-Party Threat Intelligence for Indicators of Compromise (IOCs)Apply Oracle Security Alerts and Critical Patch Updates Immediately, Monitor for Signs of Exploitation (e.g., Unusual Database Activity, Extortion Emails), Implement Multi-Factor Authentication (MFA) for Oracle EBS, Review and Secure Default Password Reset Mechanisms, Segment Networks to Limit Lateral Movement, Engage Third-Party Threat Intelligence for Indicators of Compromise (IOCs)Apply Oracle Security Alerts and Critical Patch Updates Immediately, Monitor for Signs of Exploitation (e.g., Unusual Database Activity, Extortion Emails), Implement Multi-Factor Authentication (MFA) for Oracle EBS, Review and Secure Default Password Reset Mechanisms, Segment Networks to Limit Lateral Movement, Engage Third-Party Threat Intelligence for Indicators of Compromise (IOCs)
Incident : Ransomware Attack ORA5233252112125
Recommendations: Immediate patching of CVE-2025-61882 for Oracle EBS versions 12.2.3–12.2.14, Monitor for indicators of compromise (IOCs) linked to Clop’s infrastructure (e.g., 96 IPs, support@pubstorm[.]com), Enhance authentication mechanisms for OA_HTML endpoints, Segment networks to limit lateral movement, Implement behavioral analysis for XSLT injection attemptsImmediate patching of CVE-2025-61882 for Oracle EBS versions 12.2.3–12.2.14, Monitor for indicators of compromise (IOCs) linked to Clop’s infrastructure (e.g., 96 IPs, support@pubstorm[.]com), Enhance authentication mechanisms for OA_HTML endpoints, Segment networks to limit lateral movement, Implement behavioral analysis for XSLT injection attemptsImmediate patching of CVE-2025-61882 for Oracle EBS versions 12.2.3–12.2.14, Monitor for indicators of compromise (IOCs) linked to Clop’s infrastructure (e.g., 96 IPs, support@pubstorm[.]com), Enhance authentication mechanisms for OA_HTML endpoints, Segment networks to limit lateral movement, Implement behavioral analysis for XSLT injection attemptsImmediate patching of CVE-2025-61882 for Oracle EBS versions 12.2.3–12.2.14, Monitor for indicators of compromise (IOCs) linked to Clop’s infrastructure (e.g., 96 IPs, support@pubstorm[.]com), Enhance authentication mechanisms for OA_HTML endpoints, Segment networks to limit lateral movement, Implement behavioral analysis for XSLT injection attemptsImmediate patching of CVE-2025-61882 for Oracle EBS versions 12.2.3–12.2.14, Monitor for indicators of compromise (IOCs) linked to Clop’s infrastructure (e.g., 96 IPs, support@pubstorm[.]com), Enhance authentication mechanisms for OA_HTML endpoints, Segment networks to limit lateral movement, Implement behavioral analysis for XSLT injection attempts
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are The event underscores the risks of maintaining outdated systems and the importance of clear communication in the face of cybersecurity incidents.Malvertising is an effective initial access vector for targeted phishing campaigns.,MFA bypass techniques (e.g., real-time OTP capture) undermine traditional authentication methods.,Typosquatted domains and convincing phishing pages can evade user scrutiny.,Russian-speaking threat actors continue to leverage proxy infrastructure for anonymity.,Hospitality industry is a high-value target due to sensitive guest data and payment systems.Zero-day vulnerabilities in widely used enterprise software like Oracle E-Business Suite can lead to rapid, high-impact exploitation by multiple threat actors. Organizations must prioritize patch management and assume breach scenarios even after patching, given the likelihood of prior compromise during mass exploitation campaigns.Proactive patching and hardening of ERP systems are critical to mitigating extortion risks.,Executive-targeted extortion emails require coordinated legal and security responses.,Third-party integrations in ERP systems are high-risk vectors and require strict monitoring.,Tabletop exercises help identify procedural gaps before real incidents occur.Zero-day vulnerabilities in enterprise software like Oracle EBS are high-value targets for ransomware groups.,Public PoC disclosures accelerate exploitation by multiple threat actors.,Proactive patching and exposure management are critical for mitigating RCE risks.Zero-day vulnerabilities in widely used enterprise software can lead to large-scale data breaches. Proactive patch management and monitoring for unusual network activity are critical. Vendors must ensure transparent communication during ongoing incidents to avoid misinformation.The incident underscores the critical need for timely patch management, robust cybersecurity defenses, and collaboration between healthcare providers, government agencies, and private-sector partners. Under-resourced organizations, such as rural hospitals, require additional support to mitigate cyber risks effectively. A proactive, whole-of-government approach—including offensive cyber capabilities and threat intelligence sharing—is essential to disrupt adversaries before attacks occur.Critical Importance of Timely Patching for Public-Facing Applications,Risks of Zero-Day Exploitation in Enterprise Software,Need for Enhanced Monitoring of Oracle EBS Instances,Potential for Mass Extortion Campaigns Leveraging Stolen Credentials.
What recommendations has the company implemented to improve cybersecurity ?
Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Investigate Oracle E-Business Suite environments for unusual access or compromise, Monitor for IoCs, including the listed IP addresses (200.107.207[.]26, 185.181.60[.]11) and exploit artifacts., Immediately patch Oracle E-Business Suite to the latest version., Enhance logging and network segmentation for Oracle EBS environments., Monitor networks for indicators of compromise (IoCs) provided by Google., Review Mandiant's advisory for additional mitigation strategies., Assess potential links to FIN11/Clop ransomware activity, Apply Oracle Security Alerts and Critical Patch Updates Immediately, Monitor for high-volume extortion email campaigns from compromised accounts, Implement Multi-Factor Authentication (MFA) for Oracle EBS, Monitor for Signs of Exploitation (e.g., Unusual Database Activity, Extortion Emails), Implement multi-factor authentication (MFA) for all critical systems., Engage Third-Party Threat Intelligence for Indicators of Compromise (IOCs), Conduct forensic investigations to detect signs of prior exploitation., Review and Secure Default Password Reset Mechanisms, Conduct regular security audits for enterprise software., Immediately apply Oracle's emergency patch for CVE-2025-61882., Educate employees about phishing and extortion email tactics. and Segment Networks to Limit Lateral Movement.
References
Where can I find more information about each incident ?
Incident : Data Breach ORA805033125
Source: Security Researchers at CloudSEK and Trustwave SpiderLabs
Incident : Data Breach ORA656040225
Source: Cyber Incident Description
Incident : Data Breach ORA720082025
Source: California Office of the Attorney General
Incident : phishing ORA805090225
Source: Okta Threat Intelligence (contributor: Moussa Diallo)
Incident : Extortion ORA4062140100225
Source: BleepingComputer
Incident : Extortion ORA4062140100225
Source: Mandiant (Google Cloud) & GTIG Analysis
Incident : Extortion ORA4062140100225
Source: U.S. State Department Rewards for Justice Program (Clop)
Incident : Data Breach ORA1092210100225
Source: CISA Advisory (January 2023 Oracle Incident)
Incident : Data Breach ORA1092210100225
Source: Emsisoft (MOVEit Impact Report)
Incident : Data Breach ORA5662156100625
Source: Mandiant (Google Cloud) Alert on Cl0p Campaign
Date Accessed: 2025-08
Incident : Data Breach ORA5662156100625
Source: LinkedIn Post by Charles Carmakal (Mandiant CTO)
Date Accessed: 2025-08
Incident : extortion ORA2192321100625
Source: Google Threat Analysis Group (TAG)
Incident : extortion ORA2192321100625
Source: Oracle Security Advisory (July 2025 CPU)
Incident : extortion ORA2192321100625
Source: Reuters
Incident : Data Breach ORA4993249100625
Source: Oracle Security Advisory (Rob Duhart, CSO)
Date Accessed: 2025-10-02
Incident : Data Breach ORA4993249100625
Source: Google Mandiant (Charles Carmakal, CTO) - LinkedIn Post
Date Accessed: 2025-10-02
Incident : Data Theft ORA1692116100725
Source: Oracle Security Alert (CVE-2025-61882)
Date Accessed: 2025-10-05
Incident : Data Theft ORA1692116100725
Source: watchTowr Labs (PoC Analysis)
Date Accessed: 2025-05-01
Incident : Data Theft ORA1692116100725
Source: U.S. State Department Reward Program
Incident : Data Breach ORA4202442101025
Source: TechCrunch
URL: https://techcrunch.com/2023/10/05/google-clop-oracle-zero-day-hack/
Date Accessed: 2023-10-05
Incident : Data Breach ORA4202442101025
Source: Google Blog Post
URL: https://blog.google/threat-analysis-group/clop-oracle-zero-day/
Date Accessed: 2023-10-05
Incident : Data Breach ORA4202442101025
Source: Oracle Security Advisory
URL: https://www.oracle.com/security-alerts/
Date Accessed: 2023-10-05
Incident : Data Theft ORA4092340101025
Source: American Hospital Association (AHA) Cybersecurity and Risk Webpage
Incident : Data Theft ORA4092340101025
Source: FBI Warning on Oracle E-Business Suite Vulnerability
Incident : Data Theft ORA4092340101025
Source: AHA and Microsoft Rural Health Resiliency Program
Incident : Vulnerability Exploitation ORA0832608101425
Source: SecurityAffairs
URL: https://securityaffairs.co/wordpress/150000/hacking/oracle-ebs-flaw-cve-2025-61884.html
Date Accessed: 2025-10-14
Incident : Vulnerability Exploitation ORA0832608101425
Source: Oracle Security Alert Advisory
Date Accessed: 2025-10-14
Incident : Vulnerability Exploitation ORA0832608101425
Source: Google Threat Intelligence & Mandiant Analysis
Date Accessed: 2025-10-03
Incident : Vulnerability Exploitation ORA0832608101425
Source: CrowdStrike Report on CVE-2025-61882 Exploitation
Date Accessed: 2025-10-03
Incident : data breach ORA1385213111725
Source: CyberScoop (via The Washington Post)
Date Accessed: 2025-11-14
Incident : Ransomware ORA4332743112125
Source: THE RAVEN FILE Security Researchers
Incident : Ransomware ORA4332743112125
Source: Clop Ransomware Dark Web Leak Site
Incident : Ransomware ORA4332743112125
Source: Oracle Security Alert (October 2025)
Incident : Ransomware Attack ORA5233252112125
Source: THE RAVEN FILE (Security Research)
Incident : Ransomware Attack ORA5233252112125
Source: Clop Dark Web Leak Site
Incident : Ransomware Attack ORA5233252112125
Source: Oracle Security Advisory (CVE-2025-61882)
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Security Researchers at CloudSEK and Trustwave SpiderLabs, and Source: Cyber Incident Description, and Source: California Office of the Attorney General, and Source: Okta Threat Intelligence (contributor: Moussa Diallo), and Source: BleepingComputer, and Source: Mandiant (Google Cloud) & GTIG Analysis, and Source: U.S. State Department Rewards for Justice Program (Clop)Url: https://www.state.gov/rewards-for-justice-program/, and Source: Recorded Future NewsDate Accessed: 2023-10-04, and Source: Mandiant/GTIG WarningDate Accessed: 2023-10-04, and Source: CISA Advisory (January 2023 Oracle Incident)Url: https://www.cisa.gov/, and Source: Emsisoft (MOVEit Impact Report), and Source: TechCrunchUrl: https://techcrunch.com, and Source: BloombergUrl: https://bloomberg.com, and Source: Oracle Security AdvisoryDate Accessed: 2025-08, and Source: Mandiant (Google Cloud) Alert on Cl0p CampaignDate Accessed: 2025-08, and Source: LinkedIn Post by Charles Carmakal (Mandiant CTO)Date Accessed: 2025-08, and Source: Google Threat Analysis Group (TAG), and Source: Oracle Security Advisory (July 2025 CPU), and Source: Reuters, and Source: Oracle Security Advisory (Rob Duhart, CSO)Date Accessed: 2025-10-02, and Source: Google Mandiant (Charles Carmakal, CTO) - LinkedIn PostDate Accessed: 2025-10-02, and Source: CrowdStrike BlogDate Accessed: 2025-10-07, and Source: BleepingComputer ArticleDate Accessed: 2025-10-06, and Source: Oracle Security Alert (CVE-2025-61882)Date Accessed: 2025-10-05, and Source: watchTowr Labs (PoC Analysis)Date Accessed: 2025-05-01, and Source: U.S. State Department Reward Program, and Source: TechCrunchUrl: https://techcrunch.com/2023/10/05/google-clop-oracle-zero-day-hack/Date Accessed: 2023-10-05, and Source: Google Blog PostUrl: https://blog.google/threat-analysis-group/clop-oracle-zero-day/Date Accessed: 2023-10-05, and Source: Oracle Security AdvisoryUrl: https://www.oracle.com/security-alerts/Date Accessed: 2023-10-05, and Source: American Hospital Association (AHA) Cybersecurity and Risk WebpageUrl: https://www.aha.org/cybersecurity, and Source: FBI Warning on Oracle E-Business Suite Vulnerability, and Source: AHA and Microsoft Rural Health Resiliency Program, and Source: SecurityAffairsUrl: https://securityaffairs.co/wordpress/150000/hacking/oracle-ebs-flaw-cve-2025-61884.htmlDate Accessed: 2025-10-14, and Source: Oracle Security Alert AdvisoryDate Accessed: 2025-10-14, and Source: Google Threat Intelligence & Mandiant AnalysisDate Accessed: 2025-10-03, and Source: CrowdStrike Report on CVE-2025-61882 ExploitationDate Accessed: 2025-10-03, and Source: CyberScoop (via The Washington Post)Date Accessed: 2025-11-14, and Source: THE RAVEN FILE Security Researchers, and Source: Clop Ransomware Dark Web Leak Site, and Source: Oracle Security Alert (October 2025), and Source: THE RAVEN FILE (Security Research), and Source: Clop Dark Web Leak Site, and Source: Oracle Security Advisory (CVE-2025-61882).
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Data Breach ORA344032125
Investigation Status: Ongoing
Incident : phishing ORA805090225
Investigation Status: ongoing (active campaign)
Incident : Extortion ORA4062140100225
Investigation Status: Ongoing (early stages, claims unsubstantiated)
Incident : Data Breach ORA1092210100225
Investigation Status: Ongoing (Early Stages)
Incident : ransomware ORA0193001100225
Investigation Status: ongoing (claims not yet substantiated by Google/Mandiant)
Incident : Data Breach ORA5662156100625
Investigation Status: Ongoing (developing story)
Incident : extortion ORA2192321100625
Investigation Status: ongoing (data theft claims unverified; extortion campaign confirmed)
Incident : Data Breach ORA4993249100625
Investigation Status: Ongoing (Google Mandiant involved in analysis)
Incident : Data Theft ORA1692116100725
Investigation Status: Ongoing (CrowdStrike, Mandiant, GTIG)
Incident : Data Breach ORA4202442101025
Investigation Status: Ongoing (Active Exploitation Confirmed)
Incident : Data Theft ORA4092340101025
Investigation Status: Ongoing (FBI and AHA Collaborating on Threat Intelligence and Mitigation)
Incident : Vulnerability Exploitation ORA0832608101425
Investigation Status: Ongoing (Google, Mandiant, and CrowdStrike Investigating Extent of Exploitation)
Incident : Ransomware ORA4332743112125
Investigation Status: Ongoing (infrastructure analysis links to prior MOVEit attacks)
Incident : Ransomware Attack ORA5233252112125
Investigation Status: Ongoing (Clop’s claims under verification; Oracle’s internal investigation likely)
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Customer Advisory, Letter To Users, Criticized For Lack Of Transparency, Private letters to customers, Outright Denial, Potentially Misleading Statements, Accusations Of Deleting Evidence Online, Customer Advisories About Impersonation Attempts, Industry-Wide Alerts, Public Warning Via Cybersecurity Firms (Mandiant, Gtig), Media Outreach (Recorded Future News), public disclosure via media (TechCrunch, Bloomberg); anonymous reporting channel for affected executives, Public Advisory, Linkedin Post By Oracle Cso, Mandiant Technical Alert, Route Extortion Emails Via Security And Legal Channels, Pre-Draft Customer And Regulator Communications, Public Security Advisory By Oracle Cso Rob Duhart, Linkedin Post By Google Mandiant Cto Charles Carmakal, Oracle Customer Advisory, Public Disclosure Of Poc Risks, Public Advisory By Oracle, Blog Post By Google, Media Statements, Aha Advisories With Federal Law Enforcement Input, Public Awareness Campaigns (E.G., Cybersecurity Awareness Month), Public Security Advisories and Direct Customer Notifications.
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : Data Breach ORA392622
Customer Advisories: Oracle urged Micros customers to change their passwords and any passwords used by Micros representatives to access their on-premise systems.
Incident : Data Breach ORA455040125
Customer Advisories: Private letters to customers
Incident : phishing ORA805090225
Stakeholder Advisories: Warn Customers About Impersonation Attempts, Share Indicators Of Compromise (Iocs) With Industry Peers.
Customer Advisories: avoid clicking on sponsored search ads for hospitality servicesverify URLs before entering credentialsreport suspicious login pages
Incident : Extortion ORA4062140100225
Customer Advisories: Recommended: Investigate Oracle E-Business Suite for compromise
Incident : Data Breach ORA1092210100225
Stakeholder Advisories: Mandiant/Gtig Warning To Corporate Executives.
Incident : ransomware ORA0193001100225
Stakeholder Advisories: executives at affected organizations advised to report extortion attempts securely
Incident : Data Breach ORA5662156100625
Stakeholder Advisories: Oracle and Mandiant have issued public advisories urging immediate action.
Customer Advisories: Customers advised to patch and investigate potential compromise.
Incident : extortion ORA2192321100625
Stakeholder Advisories: Cfos And Cisos Advised To Prioritize Patching And Hardening Ebs Environments.
Customer Advisories: Oracle urged customers to apply July 2025 CPU and review security controls
Incident : Data Breach ORA4993249100625
Stakeholder Advisories: Oracle Customers Urged To Patch Immediately, Executives Warned About Extortion Emails.
Customer Advisories: Patch installation guidanceIoCs for detecting compromise
Incident : Data Theft ORA1692116100725
Stakeholder Advisories: Oracle Urgent Patching Advisory, Crowdstrike Threat Assessment.
Customer Advisories: Extortion Emails from Clop to Executives
Incident : Data Breach ORA4202442101025
Stakeholder Advisories: Oracle and Google have issued advisories with technical details for detection and mitigation.
Customer Advisories: Organizations using Oracle E-Business Suite advised to apply patches and monitor for suspicious activity.
Incident : Data Theft ORA4092340101025
Stakeholder Advisories: AHA provides timely alerts and advisories to member hospitals and health systems, incorporating input from federal law enforcement and AHA cybersecurity experts (John Riggi and Scott Gee).
Customer Advisories: Patients and the public are advised to stay informed about potential disruptions to healthcare services and to report suspicious activities. Hospitals are encouraged to communicate transparently with patients about cybersecurity measures and any impacts on care delivery.
Incident : Vulnerability Exploitation ORA0832608101425
Stakeholder Advisories: Oracle Customers Urged To Patch Immediately, Executives Warned About Extortion Emails.
Customer Advisories: Apply Emergency Patches for CVE-2025-61884 and CVE-2025-61882Monitor for Suspicious Activity
Incident : Ransomware Attack ORA5233252112125
Customer Advisories: Extortion emails sent to victims via support@pubstorm[.]com
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Oracle urged Micros customers to change their passwords and any passwords used by Micros representatives to access their on-premise systems., Private letters to customers, Warn Customers About Impersonation Attempts, Share Indicators Of Compromise (Iocs) With Industry Peers, Avoid Clicking On Sponsored Search Ads For Hospitality Services, Verify Urls Before Entering Credentials, Report Suspicious Login Pages, , Recommended: Investigate Oracle E-Business Suite for compromise, Mandiant/Gtig Warning To Corporate Executives, executives at affected organizations advised to report extortion attempts securely, Oracle and Mandiant have issued public advisories urging immediate action., Customers advised to patch and investigate potential compromise., Cfos And Cisos Advised To Prioritize Patching And Hardening Ebs Environments, Oracle Urged Customers To Apply July 2025 Cpu And Review Security Controls, , Oracle Customers Urged To Patch Immediately, Executives Warned About Extortion Emails, Patch Installation Guidance, Iocs For Detecting Compromise, , Oracle Urgent Patching Advisory, Crowdstrike Threat Assessment, Extortion Emails From Clop To Executives, , Oracle and Google have issued advisories with technical details for detection and mitigation., Organizations using Oracle E-Business Suite advised to apply patches and monitor for suspicious activity., AHA provides timely alerts and advisories to member hospitals and health systems, incorporating input from federal law enforcement and AHA cybersecurity experts (John Riggi and Scott Gee)., Patients and the public are advised to stay informed about potential disruptions to healthcare services and to report suspicious activities. Hospitals are encouraged to communicate transparently with patients about cybersecurity measures and any impacts on care delivery., Oracle Customers Urged To Patch Immediately, Executives Warned About Extortion Emails, Apply Emergency Patches For Cve-2025-61884 And Cve-2025-61882, Monitor For Suspicious Activity, , Extortion Emails Sent To Victims Via Support@Pubstorm[.]Com and .
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : Malware Infection MIC1953291023
Entry Point: Troubleshooting Site,
High Value Targets: Micros Point-Of-Sale Systems,
Data Sold on Dark Web: Micros Point-Of-Sale Systems,
Incident : Data Breach ORA615032225
Entry Point: CVE-2021-35587
Incident : phishing ORA805090225
Entry Point: Malvertising (Malicious Search Engine Ads), Typosquatted Domains,
High Value Targets: Cloud-Based Property Management Systems, Guest Messaging Platforms, Payment Processing Systems,
Data Sold on Dark Web: Cloud-Based Property Management Systems, Guest Messaging Platforms, Payment Processing Systems,
Incident : Extortion ORA4062140100225
Entry Point: Compromised Email Accounts
High Value Targets: Executives at multiple companies
Data Sold on Dark Web: Executives at multiple companies
Incident : Data Breach ORA1092210100225
Entry Point: Compromised Email Accounts, Potential Exploitation Of Oracle E-Business Suite Vulnerabilities,
High Value Targets: Corporate Executives, Finance/Hr/Supply Chain Data,
Data Sold on Dark Web: Corporate Executives, Finance/Hr/Supply Chain Data,
Incident : ransomware ORA0193001100225
Entry Point: Compromised Email Accounts, Oracle E-Business Suite Web-Portals,
High Value Targets: Executives At Large Organizations,
Data Sold on Dark Web: Executives At Large Organizations,
Incident : Data Breach ORA5662156100625
Entry Point: Oracle E-Business Suite Concurrent Processing Component (via HTTP)
High Value Targets: Enterprise data within Oracle EBS environments
Data Sold on Dark Web: Enterprise data within Oracle EBS environments
Incident : extortion ORA2192321100625
Entry Point: Phishing/Extortion Emails Targeting Executives,
High Value Targets: Ebs Finance, Supply-Chain, And Crm Data,
Data Sold on Dark Web: Ebs Finance, Supply-Chain, And Crm Data,
Incident : Data Breach ORA4993249100625
Entry Point: CVE-2025-61882 (Oracle E-Business Suite zero-day)
Reconnaissance Period: Likely conducted prior to August 2025 (exploitation began in August)
High Value Targets: Corporate Executives' Personal Data,
Data Sold on Dark Web: Corporate Executives' Personal Data,
Incident : Data Theft ORA1692116100725
Entry Point: Cve-2025-61882 (Oracle Ebs Bi Publisher),
Reconnaissance Period: ['Potentially since early August 2025 (zero-day exploitation)']
High Value Targets: Sensitive Corporate Documents,
Data Sold on Dark Web: Sensitive Corporate Documents,
Incident : Data Breach ORA4202442101025
Entry Point: Zero-Day Vulnerability in Oracle E-Business Suite (Network-Based, No Authentication Required)
Reconnaissance Period: Since at least 2023-07-10
High Value Targets: Corporate Executives, Hr And Customer Data,
Data Sold on Dark Web: Corporate Executives, Hr And Customer Data,
Incident : Data Theft ORA4092340101025
Entry Point: Exploitation of Unpatched Vulnerability in Oracle’s E-Business Suite
High Value Targets: Patient Data, Healthcare It Systems, Clinical Operations,
Data Sold on Dark Web: Patient Data, Healthcare It Systems, Clinical Operations,
Incident : Vulnerability Exploitation ORA0832608101425
Entry Point: Exploitation Of Oracle Ebs Vulnerabilities (Cve-2025-61882, Cve-2025-61884), Hacked User Emails, Default Password Reset Mechanisms,
Reconnaissance Period: Potentially Began on 2025-07-10 (Prior to July Patches)
High Value Targets: Company Executives (Extortion Emails), Oracle Ebs Databases,
Data Sold on Dark Web: Company Executives (Extortion Emails), Oracle Ebs Databases,
Incident : data breach ORA1385213111725
Entry Point: Oracle E-Business Suite zero-day exploit
High Value Targets: Employee Data, Contractor Data,
Data Sold on Dark Web: Employee Data, Contractor Data,
Incident : Ransomware ORA4332743112125
Entry Point: OA_HTML/SyncServlet (Authentication Bypass) & OA_HTML/RF.jsp (XSLT Injection)
Reconnaissance Period: Observed as early as June 2025, active exploitation from August 2025
High Value Targets: Oracle E-Business Suite Erp Data, Financial Records, Personal Records,
Data Sold on Dark Web: Oracle E-Business Suite Erp Data, Financial Records, Personal Records,
Incident : Ransomware Attack ORA5233252112125
Entry Point: Oracle E-Business Suite (Ebs) Syncservlet Endpoint,
Reconnaissance Period: Likely conducted prior to August 2025 (exploitation start date)
High Value Targets: Erp Data (Order Management, Procurement, Logistics), Customer Databases,
Data Sold on Dark Web: Erp Data (Order Management, Procurement, Logistics), Customer Databases,
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Malware Infection MIC1953291023
Root Causes: Weak Password Management, Credential Theft,
Corrective Actions: Password Reset, Malware Removal,
Incident : Data Breach ORA615032225
Root Causes: Vulnerable software version, compromised subdomain
Incident : phishing ORA805090225
Root Causes: Over-Reliance On Traditional Mfa Methods Vulnerable To Real-Time Phishing., Lack Of Visibility Into Malvertising Campaigns Targeting Brand Impersonation., Insufficient Monitoring For Typosquatted Domains And Beaconing Activity.,
Corrective Actions: Replace Sms/Email-Based Mfa With Phishing-Resistant Alternatives., Proactively Register Defensive Domains To Prevent Typosquatting., Enhance Threat Intelligence Sharing Within The Hospitality Sector., Deploy Solutions To Detect And Block Malicious Ads In Search Results.,
Incident : ransomware ORA0193001100225
Root Causes: Exploitation Of Zero-Day Vulnerabilities In Oracle E-Business Suite, Abuse Of Default Password-Reset Functionality, Compromised Email Accounts Used For Phishing,
Incident : Data Breach ORA5662156100625
Root Causes: Zero-Day Vulnerability (Cve-2025-61882) In Oracle E-Business Suite., Lack Of Authentication Requirements For Exploitation., High-Volume Email Campaign Leveraging Compromised Accounts (Per Mandiant).,
Corrective Actions: Emergency Patch Release By Oracle., Public Disclosure And Customer Advisories., Collaboration With Mandiant For Threat Intelligence Sharing.,
Incident : extortion ORA2192321100625
Root Causes: Potential Exploitation Of Unpatched Vulnerabilities In Oracle Ebs., Targeted Phishing/Extortion Emails Leveraging Executive Pressure.,
Corrective Actions: Immediate Patching And Hardening Of Ebs Environments., Enhanced Monitoring Of Third-Party Integrations And Privileged Access., Proactive Tabletop Exercises To Improve Incident Response Readiness.,
Incident : Data Breach ORA4993249100625
Root Causes: Zero-Day Vulnerability (Cve-2025-61882) In Oracle E-Business Suite, Insufficient Proactive Patching For Prior Vulnerabilities (July 2025 Patches Bypassed),
Corrective Actions: Patch Deployment, Customer Advisory For Ioc Monitoring,
Incident : Data Theft ORA1692116100725
Root Causes: Unpatched Oracle Ebs Vulnerability (Cve-2025-61882), Internet-Exposed Ebs Applications Without Authentication Safeguards, Delayed Patching Despite Active Exploitation,
Corrective Actions: Apply Oracle’S Security Patch For Cve-2025-61882., Implement Network Segmentation For Ebs Environments., Deploy Behavioral Detection For Rce Attempts (E.G., Crowdstrike Falcon)., Conduct Threat Hunting For Signs Of Clop Or Graceful Spider Activity.,
Incident : Data Breach ORA4202442101025
Root Causes: Unpatched Zero-Day Vulnerability In Oracle E-Business Suite, Inadequate Initial Response By Oracle (Premature Claim Of Patch Effectiveness), Lack Of Network Segmentation Or Access Controls To Limit Exploitation,
Corrective Actions: Oracle Released Emergency Patches And Advisories, Google Shared Detection Indicators For Affected Organizations, Recommended Enhanced Monitoring For Extortion Emails And Unusual Data Access,
Incident : Data Theft ORA4092340101025
Root Causes: Unpatched Critical Vulnerability In Oracle’S E-Business Suite, Insufficient Cybersecurity Resources In Some Healthcare Organizations (E.G., Rural Hospitals), Sophisticated And Evolving Tactics By Cybercriminals And Nation-State Actors,
Corrective Actions: Mandatory Patch Management Protocols For Critical Software, Enhanced Collaboration Between Healthcare Providers, Government Agencies, And Cybersecurity Firms, Expanded Access To Cybersecurity Training And Resources For Under-Resourced Organizations, Development Of Offensive Cyber Capabilities To Disrupt Adversaries Proactively,
Incident : Vulnerability Exploitation ORA0832608101425
Root Causes: Unpatched Vulnerabilities In Oracle E-Business Suite, Lack Of Authentication For Remote Exploitation, Potential Weaknesses In Default Password Reset Mechanisms, Delayed Patch Deployment By Some Customers,
Corrective Actions: Oracle Released Out-Of-Band Patches, Customers Advised To Apply Patches And Monitor Systems, Enhanced Threat Intelligence Sharing (E.G., Poc Disclosure As Ioc),
Incident : Ransomware ORA4332743112125
Root Causes: Zero-Day Exploit (Cve-2025-61882), Delayed Patch Release (Exploited For Months Pre-Patch), Reused Attack Infrastructure From Moveit (Cve-2023-34362),
Corrective Actions: Patch Deployment (October 2025), Infrastructure Monitoring For 96 Linked Ips (41 Subnets Reused From Moveit),
Incident : Ransomware Attack ORA5233252112125
Root Causes: Unpatched Zero-Day Vulnerability (Cve-2025-61882) In Oracle Ebs, Lack Of Pre-Authentication Protections For Syncservlet Endpoint, Reuse Of Attack Infrastructure From Prior Campaigns (E.G., Moveit Cve-2023-34362),
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Cloudsek, Trustwave Spiderlabs, , Okta Threat Intelligence (Analysis By Moussa Diallo), , Real-Time Tracking Of Typosquatted Domains, Beaconing Detection, , Mandiant (Google Cloud), Gtig, , Recommended (for unusual access), Mandiant (Google Cloud), Google Threat Intelligence Group (Gtig), , Mandiant (Google’S Incident Response Unit), Halcyon (Counter-Ransomware Firm), , Mandiant (Google Cloud), , Recommended for customers to detect prior compromise, Monitor Erp Integration Points For Anomalies, , Google Mandiant (Investigation And Advisory), , Crowdstrike (Detection And Analysis), Mandiant (Investigation), Google Threat Intelligence Group (Gtig), , Recommended For Oracle Ebs Environments, , Google Security Researchers, , Recommended (Google Provided Indicators for Detection), Aha’S Preferred Cybersecurity Provider Program, Microsoft (Via Rural Health Resiliency Program), , Google Threat Intelligence, Mandiant, Crowdstrike, , Recommended (Oracle Advised Customers to Monitor for Exploitation Attempts), Security Researchers (The Raven File), .
What corrective actions has the company taken based on post-incident analysis ?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Password Reset, Malware Removal, , Replace Sms/Email-Based Mfa With Phishing-Resistant Alternatives., Proactively Register Defensive Domains To Prevent Typosquatting., Enhance Threat Intelligence Sharing Within The Hospitality Sector., Deploy Solutions To Detect And Block Malicious Ads In Search Results., , Emergency Patch Release By Oracle., Public Disclosure And Customer Advisories., Collaboration With Mandiant For Threat Intelligence Sharing., , Immediate Patching And Hardening Of Ebs Environments., Enhanced Monitoring Of Third-Party Integrations And Privileged Access., Proactive Tabletop Exercises To Improve Incident Response Readiness., , Patch Deployment, Customer Advisory For Ioc Monitoring, , Apply Oracle’S Security Patch For Cve-2025-61882., Implement Network Segmentation For Ebs Environments., Deploy Behavioral Detection For Rce Attempts (E.G., Crowdstrike Falcon)., Conduct Threat Hunting For Signs Of Clop Or Graceful Spider Activity., , Oracle Released Emergency Patches And Advisories, Google Shared Detection Indicators For Affected Organizations, Recommended Enhanced Monitoring For Extortion Emails And Unusual Data Access, , Mandatory Patch Management Protocols For Critical Software, Enhanced Collaboration Between Healthcare Providers, Government Agencies, And Cybersecurity Firms, Expanded Access To Cybersecurity Training And Resources For Under-Resourced Organizations, Development Of Offensive Cyber Capabilities To Disrupt Adversaries Proactively, , Oracle Released Out-Of-Band Patches, Customers Advised To Apply Patches And Monitor Systems, Enhanced Threat Intelligence Sharing (E.G., Poc Disclosure As Ioc), , Patch Deployment (October 2025), Infrastructure Monitoring For 96 Linked Ips (41 Subnets Reused From Moveit), .
Additional Questions
General Information
What was the amount of the last ransom demanded ?
Last Ransom Demanded: The amount of the last ransom demanded was $50 million (in at least one case).
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident were an Russian Cybercrime Group, rose87168, 'rose87168', Rose87168, rose87168, Unauthorized Individual, Russian-speaking cybercriminalsunknown APT/group (potential initial access brokers), FIN11 (suspected)Clop Ransomware Gang (potential link), Clop (FIN11)Potentially Impersonating Clop, Clop ransomware gang, Cl0p Ransomware GroupScattered LAPSUS$ Hunters, Clop (hacking group linked to ransomware and extortion), Clop Ransomware GangGRACEFUL SPIDER (moderate confidence), Clop Ransomware/Extortion Gang, Sophisticated CybercriminalsNation-State Sponsored Actors, Cl0p Ransomware Group (Graceful Spider)FIN11Potential involvement of Scattered Spider, Slippy Spider (Lapsus$), ShinyHunters, Clop ransomware group, Clop Ransomware Gang (Graceful Spider), Name: ['Clop Ransomware Gang', 'Graceful Spider']Origin: Russian-linkedConfirmed Victims: 1025Ransom Extracted: $500 million (since 2019)Associated Infrastructure: {'ip_addresses': 96, 'reused_ips_from_moveit': 41, 'geographic_distribution': [{'country': 'Germany', 'ip_count': 16}, {'country': 'Brazil', 'ip_count': 13}, {'country': 'Panama', 'ip_count': 12}] and 'service_providers': ['Russian-based']}.
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2013-07-10.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-10.
Impact of the Incidents
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Credit Card Payment Information, , Payment Card Data, , SSO passwords, Java Keystore files, Key files, JPS keys, , JKS files, Encrypted SSO passwords, Key files, JPS keys, , Electronic Health Records (EHR), , SSO credentials, LDAP passwords, OAuth2 keys, , Personal Information, usernames, email addresses, hashed passwords, SSO credentials, LDAP credentials, JKS files, Enterprise Manager JPS keys, , User Emails, Hashed Passwords, Usernames, , Names, Social Security Numbers, , guest personal information, payment data, booking system credentials, operational data, , Potentially Finance, HR, and Supply Chain Data (Oracle E-Business Suite), , customer databases, employee information, human resources files, , Large amounts of data (exact scope undisclosed), Personal information of corporate executives, Customer data, Employee HR files, , Sensitive Documents, Potentially PII or Corporate Data, , Corporate Executive Data, Customer Data, Employee HR Files, Sensitive Corporate Data, , , Sensitive Resources, Potential Oracle E-Business Suite Data (as claimed in extortion emails), , , Financial Records, Personal Records, ERP Data, , Internal Corporate Data, Customer Information, Financial Records, Personal Data and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident was MICROS Point-of-Sale Systems and MICROS Point-of-Sale Systems and and Legacy Servers and legacy Cerner data migration servers and Login ServersLegacy Cerner Data and Gen 1 serverslegacy systems and Oracle Cloud Classic Servers and cloud-based property management systemsguest messaging platformsauthentication systems and Oracle E-Business Suite (potential) and Oracle E-Business Suite and Oracle E-Business Suite web-portals and and Oracle E-Business Suite (EBS) and Oracle E-Business Suite and Oracle E-Business Suite (EBS) with unpatched BI Publisher Integration and Oracle E-Business Suite and and Oracle E-Business Suite (Versions 12.2.3–12.2.14)Runtime UI ComponentBI Publisher IntegrationConcurrent Processing Component and Oracle E-Business Suite (Versions 12.2.3–12.2.14)Internal Corporate Systems and Oracle E-Business Suite (EBS) ServersEnterprise Resource Planning (ERP) Systems.
Response to the Incidents
What third-party assistance was involved in the most recent incident ?
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was cloudsek, trustwave spiderlabs, , okta threat intelligence (analysis by moussa diallo), , mandiant (google cloud), gtig, , mandiant (google cloud), google threat intelligence group (gtig), , mandiant (google’s incident response unit), halcyon (counter-ransomware firm), , mandiant (google cloud), , google mandiant (investigation and advisory), , crowdstrike (detection and analysis), mandiant (investigation), google threat intelligence group (gtig), , google security researchers, , aha’s preferred cybersecurity provider program, microsoft (via rural health resiliency program), , google threat intelligence, mandiant, crowdstrike, , security researchers (the raven file), .
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Password Change Recommendation, Password Reset, monitoring for suspicious domain registrationsblocking known malicious domains, Emergency Patch Release (CVE-2025-61882)Advisory for Customer Mitigation, patch verification (July 2025 CPU)rotate SSO tokensenforce MFA on EBS admin/service accountsreview privileged roles and recent admin logins for anomalies, Patch release (CVE-2025-61882)Indicators of Compromise (IoCs) shared with customers, Patching CVE-2025-61882Disabling Exposed EBS Components, Immediate Software Patch Installation (Oracle’s E-Business Suite)Long-Term Cyber Incident Response Planning and Emergency Patching (CVE-2025-61884 & CVE-2025-61882)Urgent Advisory for Customers to Apply Updates.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Sensitive Corporate Data, Hashed Passwords, Personal information of corporate executives, Customer Data, Potentially Finance, HR, and Supply Chain Data (Oracle E-Business Suite), SSO credentials, Financial Records, Corporate Executive Data, LDAP credentials, Names, Personal Data, Social Security Numbers, Sensitive Resources, LDAP passwords, Encrypted SSO passwords, ERP Data, Employee HR Files, usernames, Internal Corporate Data, Enterprise Manager JPS keys, hashed passwords, Customer data, JKS files, payment data, human resources files, Potential Oracle E-Business Suite Data (as claimed in extortion emails), Key files, employee information, booking system credentials, Large amounts of data (exact scope undisclosed), JPS keys, Electronic Health Records (EHR), Usernames, email addresses, User Emails, Potentially PII or Corporate Data, Personal Records, Credit Card Payment Information, Payment Card Data, Sensitive Documents, customer databases, SSO passwords, Employee HR files, operational data, OAuth2 keys, Personal Information, guest personal information, Java Keystore files and Customer Information.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 18.0M.
Ransomware Information
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Potential for Mass Extortion Campaigns Leveraging Stolen Credentials.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Enforce MFA and rotate credentials for EBS admin/service accounts., Educate employees and customers about malvertising and phishing risks., Adopt phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn)., Restrict internet exposure of EBS applications and enforce authentication controls., Install Oracle's patch for CVE-2025-61882 immediately, Strengthen Public-Private Partnerships to Share Threat Intelligence and Best Practices, Enhance security for executive personal data, Deploy behavioral analytics to detect beaconing and tracking scripts., Monitor for suspicious domain registrations (e.g., typosquatting)., Investigate Oracle E-Business Suite environments for unusual access or compromise, Monitor for indicators of compromise (IOCs) linked to Clop’s infrastructure (e.g., 96 IPs, support@pubstorm[.]com), Monitor for IoCs, including the listed IP addresses (200.107.207[.]26, 185.181.60[.]11) and exploit artifacts., Immediately patch Oracle E-Business Suite to the latest version., Enhance logging and network segmentation for Oracle EBS environments., Participate in Free or Discounted Cybersecurity Assessments (e.g., Microsoft’s Rural Health Resiliency Program), Review third-party vulnerability disclosures for proactive patching, Collaborate with threat intelligence providers (e.g., Okta) for IOCs., Monitor networks for indicators of compromise (IoCs) provided by Google., Immediately patch CVE-2025-61882 in Oracle E-Business Suite environments., Implement adaptive risk assessments to detect anomalous access patterns., Monitor for signs of data exfiltration, especially via BI Publisher components., Segment networks to limit lateral movement, Review Mandiant's advisory for additional mitigation strategies., Monitor systems for Indicators of Compromise (IoCs) provided by Oracle, Assess potential links to FIN11/Clop ransomware activity, Apply Oracle Security Alerts and Critical Patch Updates Immediately, Monitor integration logs for anomalies or unauthorized access attempts., Monitor for high-volume extortion email campaigns from compromised accounts, Implement Multi-Factor Authentication (MFA) for Oracle EBS, Monitor for Signs of Exploitation (e.g., Unusual Database Activity, Extortion Emails), Implement multi-factor authentication (MFA) for all critical systems., Invest in Training and Certifications for IT Staff, Particularly in Rural Healthcare Settings, Prepare for extortion attempts if using Oracle EBS, given Clop’s history of targeting such vulnerabilities., Engage Third-Party Threat Intelligence for Indicators of Compromise (IOCs), Preserve extortion email artifacts for forensic analysis., Install Immediate Patches for Oracle’s E-Business Suite and Other Critical Systems, Enhance Security Measures, Conduct forensic investigations to detect signs of prior exploitation., Engage threat intelligence services (e.g., CrowdStrike, Mandiant) for proactive detection., Conduct a thorough review of privileged roles and recent logins., Inventory and re-authorize all third-party integrations with EBS., Immediate patching of CVE-2025-61882 for Oracle EBS versions 12.2.3–12.2.14, Run ERP-compromise tabletop exercises to test response readiness., Implement behavioral analysis for XSLT injection attempts, Restrict access to property management systems with zero-trust principles., Apply the July 2025 Oracle Critical Patch Update immediately., Review and Secure Default Password Reset Mechanisms, Develop and Maintain a Comprehensive Cyber Incident Response Plan, Change Passwords, Enhance authentication mechanisms for OA_HTML endpoints, Conduct regular security audits for enterprise software., Immediately apply Oracle's emergency patch for CVE-2025-61882., Leverage AHA’s Cybersecurity Resources, Including Preferred Provider Programs and Advisory Services, Advocate for Federal and Allied Nation Interventions to Deter Cyber Adversaries, Plan for Clinical Continuity During Cyber Disruptions, Educate employees about phishing and extortion email tactics. and Segment Networks to Limit Lateral Movement.
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are FBI Warning on Oracle E-Business Suite Vulnerability, U.S. State Department Reward Program, Oracle Security Advisory (CVE-2025-61882), SecurityAffairs, Clop Ransomware Dark Web Leak Site, Clop Dark Web Leak Site, TechCrunch, Google Threat Analysis Group (TAG), Google Mandiant (Charles Carmakal, CTO) - LinkedIn Post, Mandiant (Google Cloud) Alert on Cl0p Campaign, Okta Threat Intelligence (contributor: Moussa Diallo), CrowdStrike Report on CVE-2025-61882 Exploitation, Google Blog Post, Oracle Security Advisory, California Office of the Attorney General, THE RAVEN FILE (Security Research), LinkedIn Post by Charles Carmakal (Mandiant CTO), Oracle Security Advisory (Rob Duhart, CSO), BleepingComputer Article, Oracle Security Advisory (July 2025 CPU), Recorded Future News, Emsisoft (MOVEit Impact Report), THE RAVEN FILE Security Researchers, Oracle Security Alert (October 2025), Security Researchers at CloudSEK and Trustwave SpiderLabs, U.S. State Department Rewards for Justice Program (Clop), watchTowr Labs (PoC Analysis), CrowdStrike Blog, Oracle Security Alert (CVE-2025-61882), AHA and Microsoft Rural Health Resiliency Program, CISA Advisory (January 2023 Oracle Incident), Cyber Incident Description, Oracle Security Alert Advisory, CyberScoop (via The Washington Post), Reuters, BleepingComputer, Mandiant (Google Cloud) & GTIG Analysis, Mandiant/GTIG Warning, Google Threat Intelligence & Mandiant Analysis, Bloomberg and American Hospital Association (AHA) Cybersecurity and Risk Webpage.
What is the most recent URL for additional resources on cybersecurity best practices ?
Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://www.state.gov/rewards-for-justice-program/, https://www.cisa.gov/, https://techcrunch.com, https://bloomberg.com, https://techcrunch.com/2023/10/05/google-clop-oracle-zero-day-hack/, https://blog.google/threat-analysis-group/clop-oracle-zero-day/, https://www.oracle.com/security-alerts/, https://www.aha.org/cybersecurity, https://securityaffairs.co/wordpress/150000/hacking/oracle-ebs-flaw-cve-2025-61884.html .
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing.
Stakeholder and Customer Advisories
What was the most recent stakeholder advisory issued ?
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was warn customers about impersonation attempts, share indicators of compromise (IOCs) with industry peers, Mandiant/GTIG Warning to Corporate Executives, executives at affected organizations advised to report extortion attempts securely, Oracle and Mandiant have issued public advisories urging immediate action., CFOs and CISOs advised to prioritize patching and hardening EBS environments, Oracle customers urged to patch immediately, Executives warned about extortion emails, Oracle Urgent Patching Advisory, CrowdStrike Threat Assessment, Oracle and Google have issued advisories with technical details for detection and mitigation., AHA provides timely alerts and advisories to member hospitals and health systems, incorporating input from federal law enforcement and AHA cybersecurity experts (John Riggi and Scott Gee)., Oracle Customers Urged to Patch Immediately, Executives Warned About Extortion Emails, .
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued were an Oracle urged Micros customers to change their passwords and any passwords used by Micros representatives to access their on-premise systems., Private letters to customers, avoid clicking on sponsored search ads for hospitality servicesverify URLs before entering credentialsreport suspicious login pages, Recommended: Investigate Oracle E-Business Suite for compromise, Customers advised to patch and investigate potential compromise., Oracle urged customers to apply July 2025 CPU and review security controls, Patch installation guidanceIoCs for detecting compromise, Extortion Emails from Clop to Executives, Organizations using Oracle E-Business Suite advised to apply patches and monitor for suspicious activity., Patients and the public are advised to stay informed about potential disruptions to healthcare services and to report suspicious activities. Hospitals are encouraged to communicate transparently with patients about cybersecurity measures and any impacts on care delivery., Apply Emergency Patches for CVE-2025-61884 and CVE-2025-61882Monitor for Suspicious Activity and Extortion emails sent to victims via support@pubstorm[.]com.
Initial Access Broker
What was the most recent entry point used by an initial access broker ?
Most Recent Entry Point: The most recent entry point used by an initial access broker were an Oracle E-Business Suite Concurrent Processing Component (via HTTP), Zero-Day Vulnerability in Oracle E-Business Suite (Network-Based, No Authentication Required), Compromised Email Accounts, CVE-2021-35587, CVE-2025-61882 (Oracle E-Business Suite zero-day), OA_HTML/SyncServlet (Authentication Bypass) & OA_HTML/RF.jsp (XSLT Injection), Oracle E-Business Suite zero-day exploit and Exploitation of Unpatched Vulnerability in Oracle’s E-Business Suite.
What was the most recent reconnaissance period for an incident ?
Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was Likely conducted prior to August 2025 (exploitation began in August), Potentially since early August 2025 (zero-day exploitation), Since at least 2023-07-10, Potentially Began on 2025-07-10 (Prior to July Patches), Observed as early as June 2025, active exploitation from August 2025, Likely conducted prior to August 2025 (exploitation start date).
Post-Incident Analysis
What was the most significant root cause identified in post-incident analysis ?
Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Weak Password ManagementCredential Theft, Vulnerable software version, compromised subdomain, Over-reliance on traditional MFA methods vulnerable to real-time phishing.Lack of visibility into malvertising campaigns targeting brand impersonation.Insufficient monitoring for typosquatted domains and beaconing activity., exploitation of zero-day vulnerabilities in Oracle E-Business Suiteabuse of default password-reset functionalitycompromised email accounts used for phishing, Zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite.Lack of authentication requirements for exploitation.High-volume email campaign leveraging compromised accounts (per Mandiant)., Potential exploitation of unpatched vulnerabilities in Oracle EBS.Targeted phishing/extortion emails leveraging executive pressure., Zero-day vulnerability (CVE-2025-61882) in Oracle E-Business SuiteInsufficient proactive patching for prior vulnerabilities (July 2025 patches bypassed), Unpatched Oracle EBS vulnerability (CVE-2025-61882)Internet-exposed EBS applications without authentication safeguardsDelayed patching despite active exploitation, Unpatched Zero-Day Vulnerability in Oracle E-Business SuiteInadequate Initial Response by Oracle (Premature Claim of Patch Effectiveness)Lack of Network Segmentation or Access Controls to Limit Exploitation, Unpatched Critical Vulnerability in Oracle’s E-Business SuiteInsufficient Cybersecurity Resources in Some Healthcare Organizations (e.g., Rural Hospitals)Sophisticated and Evolving Tactics by Cybercriminals and Nation-State Actors, Unpatched Vulnerabilities in Oracle E-Business SuiteLack of Authentication for Remote ExploitationPotential Weaknesses in Default Password Reset MechanismsDelayed Patch Deployment by Some Customers, Zero-Day Exploit (CVE-2025-61882)Delayed Patch Release (exploited for months pre-patch)Reused Attack Infrastructure from MOVEit (CVE-2023-34362), Unpatched zero-day vulnerability (CVE-2025-61882) in Oracle EBSLack of pre-authentication protections for SyncServlet endpointReuse of attack infrastructure from prior campaigns (e.g., MOVEit CVE-2023-34362).
What was the most significant corrective action taken based on post-incident analysis ?
Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Password ResetMalware Removal, Replace SMS/email-based MFA with phishing-resistant alternatives.Proactively register defensive domains to prevent typosquatting.Enhance threat intelligence sharing within the hospitality sector.Deploy solutions to detect and block malicious ads in search results., Emergency patch release by Oracle.Public disclosure and customer advisories.Collaboration with Mandiant for threat intelligence sharing., Immediate patching and hardening of EBS environments.Enhanced monitoring of third-party integrations and privileged access.Proactive tabletop exercises to improve incident response readiness., Patch deploymentCustomer advisory for IoC monitoring, Apply Oracle’s security patch for CVE-2025-61882.Implement network segmentation for EBS environments.Deploy behavioral detection for RCE attempts (e.g., CrowdStrike Falcon).Conduct threat hunting for signs of Clop or GRACEFUL SPIDER activity., Oracle Released Emergency Patches and AdvisoriesGoogle Shared Detection Indicators for Affected OrganizationsRecommended Enhanced Monitoring for Extortion Emails and Unusual Data Access, Mandatory Patch Management Protocols for Critical SoftwareEnhanced Collaboration Between Healthcare Providers, Government Agencies, and Cybersecurity FirmsExpanded Access to Cybersecurity Training and Resources for Under-Resourced OrganizationsDevelopment of Offensive Cyber Capabilities to Disrupt Adversaries Proactively, Oracle Released Out-of-Band PatchesCustomers Advised to Apply Patches and Monitor SystemsEnhanced Threat Intelligence Sharing (e.g., POC Disclosure as IOC), Patch deployment (October 2025)Infrastructure monitoring for 96 linked IPs (41 subnets reused from MOVEit).
.png)
Latest Global CVEs (Not Company-Specific)
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Risk Information
cvss4
Base: 7.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
- https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f
- https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc
- https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e
- https://github.com/angular/angular/releases/tag/19.2.16
- https://github.com/angular/angular/releases/tag/20.3.14
- https://github.com/angular/angular/releases/tag/21.0.1
- https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 8.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 6.3
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=micros-systems-inc' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
