Oracle University
Company Details
Linkedin ID:
oracle-university
Employees number:
None employees
Number of followers:
83,642
NAICS:
5415
Industry Type:
Homepage:
oracle.com
IP Addresses:
0
Company ID:
ORA_3270201
Scan Status:
In-progress
Oracle University Company CyberSecurity Posture
oracle.com
Upskill and enhance your Oracle proficiency, get Oracle certified to increase your employability and accelerate Oracle SaaS adoption with Oracle University learning content and adoption platforms. Follow us to: ✅ Be the first to hear about discounts in learning paths and certification ✅ Join the discussion on the latest trends in digital adoption and training ✅ Learn about new digital learning opportunities for Oracle solutions ✅ Get access to free Oracle learning resources
Oracle University A.I CyberSecurity Scoring
Oracle University Risk Score (AI oriented)Between 750 and 799
Oracle University
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
Oracle University Global Score (TPRM)XXXX
Oracle University
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
Oracle University Company CyberSecurity News & History
Past Incidents
23
Attack Types
4
Oracle Corporation
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: On July 10, 2013, Fidelity Investments experienced a data breach reported by the California Office of the Attorney General on July 31, 2013. An unauthorized individual gained access to a report containing sensitive personal information of **Oracle Corporation employees**, including **names and Social Security numbers**. The breach exposed confidential employee data, though the exact number of affected individuals remains undisclosed. The incident highlights a significant security lapse, as the compromised data could facilitate identity theft, financial fraud, or targeted phishing attacks against the affected employees. While the breach did not directly impact Fidelity’s customers, the exposure of third-party (Oracle) employee records underscores vulnerabilities in data handling and access controls. The breach’s discovery and reporting delay (21 days) may have further exacerbated risks, as affected individuals were left uninformed during this period. Such breaches erode trust in financial institutions’ ability to safeguard sensitive information, potentially leading to reputational damage and regulatory scrutiny. The nature of the stolen data—Social Security numbers—makes it particularly high-risk, as this information is immutable and highly valuable to cybercriminals for long-term exploitation.
Princeton University, Harvard University, Dartmouth College, Columbia University and Oracle Corp.: Hackers Strike Ivy League Schools Already Under Political Pressure
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Hackers have struck elite US universities in recent weeks, pilfering sensitive data from donors and making off with students’ information in a string of digital heists that only add stress to schools already besieged with political pressure. Dartmouth College, Harvard University, Princeton and the University of Pennsylvania have each disclosed breaches within the past three weeks, months after a politically motivated attacker burrowed deep into networks at New York City’s Columbia University. The identity of the intruders in most of the recent incidents remains a mystery. However, the hackers typically duped school employees in order to access databases of personal information about prominent individuals associated with each institution. The break-in at Harvard, which the school discovered on Nov. 18, resulted in the theft of personal data and other information from fundraisers at the school, which typically raises more than $1 billion annually. At Dartmouth, attackers exploited a software vulnerability in an Oracle Corp. product to steal files from the university, the school said in a notice Monday to people impacted by the incident. Oracle has since released a security patch for the flaw. “Universities like Harvard have a lot of valuable information like personal information about powerful people – politics, influencers, executives – and we know both criminals and countries target these institutions,” said Sergey Shykevich, threat intelligence manager at the Israeli cybe
Oracle
Breach
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Oracle recently faced allegations of a data breach, with a threat actor claiming to have stolen 6 million records from Oracle Cloud's SSO login servers. Oracle has denied any breach, stating there was no compromise of their cloud services and customers' data remained secure. The threat actor, rose87168, attempted to sell the data and claimed the information includes SSO passwords, Java Keystore files, key files, and JPS keys from Oracle Cloud servers. Despite encrypted and hashed passwords requiring decryption or cracking, the impact of such a breach—if proven accurate—could potentially be significant, undermining trust in Oracle's cloud security and potentially impacting customers whose data was compromised.
Oracle Corporation
Breach
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Oracle Corporation endured a data breach affecting its Gen 1 servers, with no complete PII exposure but involving 6 million data records including usernames, email addresses, and hashed passwords. Sensitive credentials related to SSO and LDAP were also compromised. The breach, attributed to the threat actor 'rose87168' via a 2020 Java exploit, resulted in the theft of JKS files and Enterprise Manager JPS keys from legacy systems approximately 16 months old. Oracle has informed clients and taken steps to bolster Gen 1 server security while maintaining that its Gen 2 servers and primary Oracle Cloud infrastructure remain secure.
Oracle
Breach
Rankiteo Explanation
Attack that could injure or kill people
Description: Oracle faced two data security incidents with reported poor incident communication. An attacker allegedly accessed login servers and legacy Cerner data, leading to customers' personal information being at risk. Missteps in Oracle's response include outright denial, potentially misleading statements, and accusations of deleting evidence online, compounding the damage to their reputation.
Oracle
Breach
Rankiteo Explanation
Attack threatening the organization's existence
Description: A Russian cybercrime group breached 100 computer systems belonging to Oracle's retail division and MICROS point-of-sale credit card payment systems. It did not expose corporate networks and other cloud and service offerings that were not affected by the breach. Oracle urged Micros customers to change their passwords and any passwords used by Micros representatives to access their on-premise systems.
Princeton University, Oracle Corporation and Phoenix Education Partners: University of Phoenix data breach impacts nearly 3.5 million individuals
Cyber Attack
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: **Clop Ransomware Gang Steals Data of 3.5 Million from University of Phoenix** The Clop ransomware gang has stolen the personal and financial data of nearly **3.5 million** individuals—including current and former students, staff, and suppliers—after breaching the **University of Phoenix (UoPX)** network in **August 2025**. The attack was part of a broader extortion campaign exploiting a **zero-day vulnerability (CVE-2025-61882)** in **Oracle E-Business Suite (EBS)**, a financial application used by the university. UoPX, a private for-profit institution based in **Phoenix, Arizona**, detected the breach on **November 21** after Clop listed the university on its data leak site. The stolen data includes **names, contact details, dates of birth, Social Security numbers, and bank account information**. In early December, the university publicly disclosed the incident and filed an **8-K report with the U.S. Securities and Exchange Commission (SEC)**. On **Monday**, UoPX confirmed in notification letters filed with **Maine’s Attorney General** that **3,489,274 individuals** were affected. The university is offering **free identity protection services**, including credit monitoring, dark web surveillance, and a **$1 million fraud reimbursement policy**. While UoPX has not officially attributed the attack, the tactics align with Clop’s recent campaign targeting **Oracle EBS vulnerabilities**. Other U.S. universities, including **Harvard and the University of Pennsylvania**, have also reported similar breaches linked to the same exploit. Clop has a history of high-profile data theft operations, previously targeting **GoAnywhere MFT, Accellion FTA, MOVEit Transfer, Cleo, and Gladinet CentreStack**. The U.S. Department of State has offered a **$10 million reward** for information connecting the gang’s activities to a foreign government. In a separate wave of attacks since **late October**, multiple universities—including **Harvard, Princeton, and the University of Pennsylvania**—have also fallen victim to **voice phishing (vishing) attacks**, compromising systems tied to development and alumni activities.
Oracle Hospitality
Cyber Attack
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: A large-scale phishing campaign targeted Oracle Hospitality through malicious search engine advertisements (malvertising), impersonating its services to deceive users. Victims were redirected to typosquatted domains mimicking legitimate login pages, harvesting credentials, email addresses, phone numbers, and passwords. The attackers bypassed multi-factor authentication (MFA) by capturing real-time one-time passwords (OTP) via SMS or email codes, gaining unauthorized access to cloud-based property management systems.The breach exposed sensitive guest data, including personal information and payment details, stored in these platforms. Technical analysis revealed Russian-speaking threat actors behind the operation, using sophisticated beaconing techniques to track victims’ geolocation, session duration, and engagement. The campaign posed significant risks to Oracle Hospitality’s operational integrity, customer trust, and financial security, with potential downstream impacts on booking systems and guest privacy.Security researchers highlighted the need for phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn) and adaptive risk assessments to mitigate future threats. The incident underscores the growing sophistication of industry-specific cyberattacks targeting hospitality providers.
Oracle (E-Business Suite customers)
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: A new extortion campaign targeted executives across multiple companies using **Oracle E-Business Suite**, with threat actors (potentially the **Clop ransomware gang/FIN11**) sending emails claiming theft of sensitive data. The campaign, active since at least **September 29, 2025**, leveraged **hundreds of compromised email accounts**, some linked to prior FIN11 activity. While the emails included contact details tied to Clop’s data leak site, **Mandiant and Google Cloud have not yet confirmed actual data theft**. The attack exploits potential vulnerabilities in Oracle’s platform, though no zero-day confirmation exists. Organizations were urged to investigate unusual access in their Oracle environments. Clop, known for **ransomware deployment and data extortion**, has historically exploited file transfer flaws (e.g., **Cleo zero-days in 2024**) to steal corporate data. The U.S. State Department offers a **$10M reward** for ties between Clop and foreign governments. The incident remains under investigation, with risks including **financial extortion, reputational damage, and potential data leaks** if claims are substantiated.
Oracle
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: The **Clop ransomware gang** exploited a **zero-day vulnerability** in **Oracle’s E-Business Suite**, a critical enterprise software used for managing customer data, HR files, and corporate operations. The attack, active since at least **July 10**, allowed hackers to steal **significant amounts of sensitive data**, including **personal information of corporate executives and employees**, as well as **customer data** from affected organizations. Oracle initially claimed the vulnerabilities were patched, but later confirmed the zero-day flaw enabled **remote exploitation without authentication**, meaning attackers could breach systems without credentials.Google’s security researchers revealed that **dozens of organizations** were compromised, with the Clop gang using the stolen data for **extortion campaigns**. The group has a history of **mass-hacking** via unpatched vulnerabilities in file transfer tools (e.g., **MOVEit, GoAnywhere**), amplifying risks of **large-scale data leaks**. Oracle’s delayed acknowledgment and the **ongoing exploitation** of the flaw suggest prolonged exposure, increasing potential damage to **financial records, executive identities, and corporate intellectual property**.
Oracle
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: The **Clop ransomware gang** exploited a **critical zero-day vulnerability (CVE-2025-61882)** in **Oracle E-Business Suite (EBS)**, specifically within the **BI Publisher Integration component**, to conduct **data theft attacks** since at least **August 2025**. The flaw allowed **unauthenticated remote code execution (RCE)** via a single HTTP request, enabling attackers to steal **sensitive corporate documents** from unpatched systems. Oracle patched the vulnerability in early October 2025, but not before Clop launched an **extortion campaign**, emailing executives at multiple victim organizations to demand ransoms in exchange for not leaking the stolen data.The attack leveraged a **vulnerability chain** exposed by leaked proof-of-concept (PoC) exploits from the **Scattered Lapsus$ Hunters** group, increasing the risk of further exploitation by other threat actors. Clop’s campaign mirrors past high-profile breaches, including **MOVEit Transfer (2,770+ organizations affected)**, **Accellion FTA**, and **GoAnywhere MFT**, reinforcing its reputation for **large-scale data theft via zero-days**. Oracle urged immediate patching, warning that **internet-exposed EBS applications** remain prime targets. The U.S. State Department has even offered a **$10 million reward** for intelligence linking Clop to foreign state sponsorship, underscoring the attack’s severity.
Oracle Corporation
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: The Clop ransomware gang (Graceful Spider) exploited a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite (EBS), an enterprise resource planning system used for order management, procurement, and logistics. The unauthenticated remote code execution (RCE) flaw allowed attackers to bypass authentication via the **OA_HTML/SyncServlet** endpoint and inject malicious XSLT templates through **OA_HTML/RF.jsp**, granting full control over sensitive ERP data. Oracle was listed on Clop’s dark web leak site, suggesting internal corporate data—potentially financial and employee records—was compromised. The attack leveraged reused infrastructure from prior campaigns (e.g., 2023 MOVEit exploits), with extortion emails sent to victims demanding ransom to prevent data leaks. Over **1,025 victims** and **$500M+ in extorted funds** since 2019 highlight Clop’s persistence. The breach poses severe risks to Oracle’s supply chain integrity, operational continuity, and reputation, with potential cascading effects on clients like Mazda, Humana, and the Washington Post, also listed as victims.
Oracle Corporation
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: The Clop ransomware gang (Graceful Spider) breached Oracle Corporation by exploiting a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite (EBS), an unauthenticated remote code execution (RCE) flaw with a CVSS score of 9.8. The attack bypassed authentication via the **SyncServlet** endpoint and injected malicious XSLT templates through **RF.jsp**, granting full control over enterprise systems. Oracle’s internal data and customer information were exposed, with Clop listing the company on its dark web leak site under a 'PAGE CREATED' status. The breach aligns with Clop’s broader campaign targeting high-profile victims (e.g., Mazda, Humana, Washington Post) via extortion emails threatening public data leaks unless ransoms are paid. The attack leveraged reused infrastructure from prior exploits (e.g., 2023 MOVEit vulnerability), with 96 distinct IPs tied to Russian-linked service providers. The incident underscores the severe risk posed by unpatched EBS instances, which manage critical functions like procurement, logistics, and financial records globally.
Oracle
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Hackers linked to the Russian ransomware gang **Clop (FIN11)** are exploiting vulnerabilities in **Oracle E-Business Suite**, a critical enterprise platform managing finance, HR, and supply chain data. The threat actors claim to have stolen sensitive corporate information and are conducting a **high-volume extortion campaign**, targeting executives across multiple organizations via compromised email accounts. While the exact scope of the breach remains unconfirmed, the group has historically leveraged stolen data for ransom demands rather than system disruption. Oracle previously disclosed a **January 2024 incident** where hackers accessed legacy systems and stole client credentials, raising concerns about credential reuse and exposure. The current campaign, launched on **September 29, 2024**, mirrors Clop’s past tactics—such as the **MOVEit attacks**—which impacted **2,773 organizations** and exposed **96 million records**. The group has demanded ransoms under the threat of leaking stolen data, using email addresses tied to Clop’s official leak site. Mandiant and Google Threat Intelligence Group (GTIG) are investigating but have not yet verified the full extent of the breach or the legitimacy of the stolen data claims.
Oracle (E-Business Suite)
Ransomware
Rankiteo Explanation
Attack that could injure or kill people
Description: The FBI issued an urgent warning about a **critical vulnerability in Oracle’s E-Business Suite**, exploited by cybercriminals to execute **data theft and ransomware attacks**, particularly targeting hospitals. The flaw allows attackers to **steal sensitive patient data, encrypt systems, disrupt healthcare operations, and potentially delay life-saving treatments** (e.g., surgeries, cancer care). While Oracle released a patch, the risk remains high due to the **sophistication of nation-state and criminal hackers**, who exploit unpatched systems to **shut down vital hospital infrastructure**, jeopardizing patient safety and operational continuity.The attack vector threatens **healthcare’s most critical functions**, including **core health systems, payment processes, and emergency services**, with cascading effects on **public trust and regulatory compliance**. Hospitals—already strained by resource gaps—face **financial losses from ransom demands, reputational damage from breaches, and legal liabilities** if patient data (e.g., medical records, financial details) is exposed. The AHA emphasizes that such attacks could **escalate to life-threatening disruptions**, aligning with broader warnings about cyber threats to **national health security**.
Oracle
Ransomware
Rankiteo Explanation
Attack threatening the organization's existence
Description: Oracle released an emergency patch for **CVE-2025-61882** (CVSS 9.8), a critical zero-day vulnerability in its **E-Business Suite**, actively exploited by the **Cl0p ransomware group** and potentially the **Scattered LAPSUS$ Hunters**. The flaw allows unauthenticated remote attackers to execute arbitrary code via HTTP, compromising the **Oracle Concurrent Processing** component. Cl0p leveraged this in a **high-volume phishing campaign**, stealing large volumes of sensitive data from multiple victims in **August 2025**. Indicators of compromise (IoCs) include malicious IP addresses (e.g., **200.107.207[.]26**, **185.181.60[.]11**), reverse shell payloads, and exploit scripts (e.g., *oracle_ebs_nday_exploit_poc_...*). Mandiant warned of **mass exploitation**, urging organizations to investigate potential breaches even after patching, as attackers may have already exfiltrated data. The incident highlights the risk of **supply-chain attacks** via unpatched enterprise software, with Cl0p’s campaign targeting financial, HR, and operational data—potentially disrupting business continuity and exposing customers/employees to fraud or regulatory penalties.
Oracle and Parexel: Parexel Data Breach Investigation
Vulnerability
Rankiteo Explanation
Attack without any consequences
Description: **Parexel Reports Data Breach Impacting Sensitive Employee Information** Parexel, a global clinical research organization, disclosed a data breach affecting sensitive personal information stored in its Oracle OCI E-Business Suite (Oracle EBS) environment. On **October 4, 2025**, the company detected suspicious activity within the system, prompting an investigation. The breach, confirmed through forensic analysis, revealed that an unauthorized third party accessed employee-related data. Exposed information may include **names, Social Security numbers, dates of birth, financial account numbers, payment card details (excluding CVVs), and national ID numbers**, though the exact data varies by individual. On **December 17, 2025**, Parexel began notifying affected individuals via mail, detailing the compromised information and offering **24 months of complimentary credit monitoring services**. The breach notice was filed with the **Attorney General of Massachusetts**, where impacted residents were among the first to be informed. The full scope of affected individuals and additional details remain under review.
Oracle
Vulnerability
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Oracle issued an **emergency security update** to patch a critical **information disclosure vulnerability (CVE-2025-61884, CVSS 7.5)** in its **E-Business Suite (EBS) Runtime UI component (versions 12.2.3–12.2.14)**. The flaw allows **unauthenticated remote attackers** to exploit it over a network **without credentials**, granting access to **sensitive corporate resources**, including financial, employee, or customer data. The vulnerability was part of a broader **extortion campaign** linked to the **Cl0p ransomware group (FIN11)**, which exploited a separate zero-day (CVE-2025-61882, CVSS 9.8) to **steal data** and send **extortion emails** to executives. While Oracle did not confirm active exploitation of CVE-2025-61884, the **urgent patch** suggests high risk. Attackers leveraged **hacked email accounts** and **default password resets** to gain credentials, potentially exposing **confidential business data**, **intellectual property**, or **operational secrets**. The incident highlights risks of **supply-chain attacks** and **data breaches** in enterprise software, with possible **financial fraud, reputational damage, or regulatory penalties** if exploited.
Oracle
Vulnerability
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Oracle has patched a critical zero-day vulnerability (CVE-2025-61882) in its **E-Business Suite**, actively exploited by the **Clop hacking group** to steal **personal information of corporate executives** and extort victims. The flaw allows remote exploitation without credentials, enabling mass data theft from thousands of organizations using the suite for **customer data and employee HR files**. Initially, Oracle downplayed the threat, linking extortion emails to older patched vulnerabilities from July. However, the newly discovered zero-day confirms ongoing exploitation since at least **August 2024**, with Clop demanding ransom to prevent leaking stolen data. Google’s Mandiant reported **widespread attacks**, though not all victims have been contacted yet. The breach poses severe risks to **executive privacy, corporate reputation, and operational security**, with potential cascading effects on Oracle’s enterprise clients globally.
Oracle Cloud
Breach
Rankiteo Explanation
Attack threatening the organization’s existence
Description: The cyberattack on Oracle Cloud orchestrated by 'rose87168' led to the theft of 6 million records potentially affecting over 140,000 tenants. Exfiltrated data includes sensitive JKS files, encrypted SSO passwords, key files, and JPS keys. This information is now sold on dark web forums. The breach, exploiting CVE-2021-35587, poses risks of unauthorized access and corporate espionage given the type of data stolen. Oracle's compromised subdomain and vulnerable software version highlight security gaps and raise concerns of lateral movement within the cloud environment.
Oracle Corporation: University of Phoenix Data Breach Lawsuit Investigation
Vulnerability
Rankiteo Explanation
Attack without any consequences
Description: **University of Phoenix Hit by Massive Data Breach Affecting Millions** In November 2025, the University of Phoenix disclosed a significant data breach impacting over **3.4 million current and former students and staff**. The breach, attributed to the **CL0P ransomware group**, exploited a vulnerability in the university’s **Oracle E-Business Suite software** between **August 13 and August 22, 2025**, leading to the exfiltration of sensitive personal data. **Exposed information** included names, dates of birth, Social Security numbers, and financial details such as bank account and routing numbers. The university reported the incident to the **California and Maine Attorney Generals’ offices** on **December 21, 2025**, and began notifying affected individuals the following day. Among those impacted were **9,131 Maine residents**. The breach has prompted legal action, with **Shamis & Gentile P.A.**, a class-action law firm specializing in data breach cases, investigating potential compensation for victims. The university has offered **free IDX identity theft protection services** to those affected. The University of Phoenix, a private for-profit institution based in **Phoenix, Arizona**, serves working adults through online degree programs in fields like business, healthcare, and information systems. The incident underscores the growing threat of ransomware attacks targeting educational institutions.
Oracle Health
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: A breach at Oracle Health has resulted in the theft of patient data from legacy servers impacting multiple US healthcare organizations and hospitals. Unauthorized access by a threat actor after January 22, 2025, led to the exfiltration of Electronic Health Records (EHR) data with potential violations of HIPAA laws. There is uncertainty whether ransomware was involved, but Oracle Health's response has been criticized for lack of transparency and failure to provide proper guidance and documentation, leaving hospitals to navigate the aftermath themselves.
Oracle Health
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Oracle Health, the healthcare subsidiary of Oracle Corporation, experienced a data breach involving legacy Cerner data migration servers. This incident, which Oracle has communicated to its customers through private letters, is reported to have potentially exposed sensitive customer data. The breach is a consequence of Oracle's acquisition of Cerner Corp, a notable electronic health records business, as Oracle aimed to transition the healthcare software to cloud infrastructure. The significance of the data involved and the potential ramifications of such breaches in the healthcare sector underline the serious nature of this cybersecurity event.
Oracle University Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for Oracle University
Incidents vs IT Services and IT Consulting Industry Average (This Year)
Oracle University has 33.33% more incidents than the average of same-industry companies with at least one recorded incident.
Incidents vs All-Companies Average (This Year)
Oracle University has 28.21% more incidents than the average of all companies with at least one recorded incident.
Incident Types Oracle University vs IT Services and IT Consulting Industry Avg (This Year)
Oracle University reported 1 incidents this year: 0 cyber attacks, 0 ransomware, 1 vulnerabilities, 0 data breaches, compared to industry peers with at least 1 incident.
Incident History — Oracle University (X = Date, Y = Severity)
Oracle University cyber incidents detection timeline including parent company and subsidiaries
Oracle University Company Subsidiaries
Upskill and enhance your Oracle proficiency, get Oracle certified to increase your employability and accelerate Oracle SaaS adoption with Oracle University learning content and adoption platforms. Follow us to: ✅ Be the first to hear about discounts in learning paths and certification ✅ Join the discussion on the latest trends in digital adoption and training ✅ Learn about new digital learning opportunities for Oracle solutions ✅ Get access to free Oracle learning resources
Loading...
Oracle University Similar Companies
Coforge is a global digital services and solutions provider, that leverages emerging technologies and deep domain expertise to deliver real-world business impact for its clients. A focus on select industries, a deep domain understanding of the underlying processes of those industries and partners
We are a global technology solutions company that powers breakthroughs for the world’s leading organizations. These solutions — digital workplace, cloud, applications & infrastructure, enterprise computing and business process solutions — help people overcome obstacles and not only reach their great
LexisNexis
LexisNexis Legal & Professional is a leading global provider of legal, regulatory and business information and analytics that help customers increase productivity, improve decision-making and outcomes, and advance the rule of law around the world. We help lawyers win cases, manage their work more e
NCS Group
NCS, a subsidiary of Singtel Group, is a leading technology services firm with presence in Asia Pacific and partners with governments and enterprises to advance communities through technology. Combining the experience and expertise of its 13,000-strong team across 57 specialisations, NCS provides di
For over 70 years, Iron Mountain Incorporated (NYSE: IRM) has been your strategic partner to care for your information and assets. A global leader in storage and information management services and trusted by more than 225,000 organizations around the world, including 95% of the Fortune 1000, we pro
We are an AI-led, platform-driven Digital Engineering and Enterprise Modernization partner, combining deep technical expertise and industry expertise to help our clients anticipate what’s next. Our offerings and proven solutions create a unique competitive advantage for our clients by giving them th
General Dynamics Information Technology
GDIT is a global technology and professional services company that delivers solutions, technology and mission services to every major agency across the U.S. government, defense and intelligence community. Our 30,000 experts extract the power of technology to create immediate value and deliver solut
Tietoevry
In a rapidly changing world, technology is everything. It's in the fabric of society. In every part of every business. At the very heart of human evolution. It’s a great power that comes with great responsibility. At Tietoevry, we believe it’s time to shift perspective. It’s not about what technolo
Birlasoft
Navigating Change. Powering Progress. | Reimagining the Future with Birlasoft Birlasoft, a powerhouse where domain expertise, enterprise solutions, and digital technologies converge to redefine business processes. We take pride in our consultative and design thinking approach, driving societal pro
.png)
Oracle University CyberSecurity News
December 07, 2025 08:00 AM
Dartmouth Data Breach Exposes 40,000 Social Security Numbers In Cl0p’s Oracle Rampage
Dartmouth College has confirmed that a three-day cyberattack in August compromised the personal information of more than 40,000 people,...
December 04, 2025 11:00 AM
Dartmouth College Impacted by Oracle E-Business Suite Data Breach
Dartmouth College has reported a data breach from Oracle's E-Business Suite applications, leaking the sensitive personal information of...
December 03, 2025 08:00 AM
Penn and Phoenix Universities Disclose Data Breach After Oracle Hack
The University of Pennsylvania and the University of Phoenix confirmed as victims of the Oracle's E-Business Suite (EBS) hack.
December 03, 2025 08:00 AM
University of Phoenix confirms data breach from Oracle EBS zero-day
The University of Phoenix has disclosed a cybersecurity incident involving unauthorized access to sensitive personal data through Oracle...
December 03, 2025 08:00 AM
University of Pennsylvania and University of Phoenix disclose data breaches
The University of Pennsylvania and the University of Phoenix confirm they were hit in the Oracle E-Business Suite hacking campaign.
December 02, 2025 02:36 PM
University of Pennsylvania Confirms Data Breach Linked to Oracle Hack
University of Pennsylvania confirms data breach via Oracle hack, exposing personal data in Clop ransomware gang's wider cyber campaign.
December 02, 2025 08:00 AM
Penn investigating business software data breach affecting personal records
Penn is investigating a cybersecurity breach of its Oracle E-Business Suite servers that compromised the personal information of...
December 02, 2025 08:00 AM
Ivy League Data Breaches: What Happened at UPenn, Princeton, and Columbia
UPenn becomes the third Ivy League school breached in months via Oracle vulnerability. Nearly 1500 exposed in UPenn's breach.
December 02, 2025 08:00 AM
Phoenix Education Partners reports cybersecurity incident at University of Phoenix By Investing.com
Phoenix Education Partners, Inc. (NYSE:PXED) disclosed Tuesday that its subsidiary, the University of Phoenix, experienced a cybersecurity...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
Oracle University CyberSecurity History Information
Official Website of Oracle University
The official website of Oracle University is https://www.oracle.com/education/.
Oracle University’s AI-Generated Cybersecurity Score
According to Rankiteo, Oracle University’s AI-generated cybersecurity score is 762, reflecting their Fair security posture.
How many security badges does Oracle University’ have ?
According to Rankiteo, Oracle University currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does Oracle University have SOC 2 Type 1 certification ?
According to Rankiteo, Oracle University is not certified under SOC 2 Type 1.
Does Oracle University have SOC 2 Type 2 certification ?
According to Rankiteo, Oracle University does not hold a SOC 2 Type 2 certification.
Does Oracle University comply with GDPR ?
According to Rankiteo, Oracle University is not listed as GDPR compliant.
Does Oracle University have PCI DSS certification ?
According to Rankiteo, Oracle University does not currently maintain PCI DSS compliance.
Does Oracle University comply with HIPAA ?
According to Rankiteo, Oracle University is not compliant with HIPAA regulations.
Does Oracle University have ISO 27001 certification ?
According to Rankiteo,Oracle University is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of Oracle University
Oracle University operates primarily in the IT Services and IT Consulting industry.
Number of Employees at Oracle University
Oracle University employs approximately None employees people worldwide.
Subsidiaries Owned by Oracle University
Oracle University presently has no subsidiaries across any sectors.
Oracle University’s LinkedIn Followers
Oracle University’s official LinkedIn profile has approximately 83,642 followers.
NAICS Classification of Oracle University
Oracle University is classified under the NAICS code 5415, which corresponds to Computer Systems Design and Related Services.
Oracle University’s Presence on Crunchbase
No, Oracle University does not have a profile on Crunchbase.
Oracle University’s Presence on LinkedIn
Yes, Oracle University maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/oracle-university.
Cybersecurity Incidents Involving Oracle University
As of December 23, 2025, Rankiteo reports that Oracle University has experienced 23 cybersecurity incidents.
Number of Peer and Competitor Companies
Oracle University has an estimated 38,071 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at Oracle University ?
Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack, Vulnerability, Breach and Ransomware.
How does Oracle University detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with password change recommendation, and communication strategy with customer advisory, and communication strategy with criticized for lack of transparency, and communication strategy with private letters to customers, and communication strategy with outright denial, communication strategy with potentially misleading statements, communication strategy with accusations of deleting evidence online, and remediation measures with informed clients, remediation measures with bolstered gen 1 server security, and law enforcement notified with yes (california office of the attorney general), and third party assistance with okta threat intelligence (analysis by moussa diallo), and containment measures with monitoring for suspicious domain registrations, containment measures with blocking known malicious domains, and remediation measures with implementation of phishing-resistant authentication (e.g., passkeys, fido2 webauthn), remediation measures with adaptive risk assessments for unusual access patterns, and communication strategy with customer advisories about impersonation attempts, communication strategy with industry-wide alerts, and enhanced monitoring with real-time tracking of typosquatted domains, enhanced monitoring with beaconing detection, and incident response plan activated with recommended (investigate oracle e-business suite environments), and third party assistance with mandiant (google cloud), third party assistance with gtig, and enhanced monitoring with recommended (for unusual access), and and third party assistance with mandiant (google cloud), third party assistance with google threat intelligence group (gtig), and communication strategy with public warning via cybersecurity firms (mandiant, gtig), communication strategy with media outreach (recorded future news), and and third party assistance with mandiant (google cloud), and containment measures with emergency patch release (cve-2025-61882), containment measures with advisory for customer mitigation, and remediation measures with patch application, remediation measures with investigation into potential prior compromise, and communication strategy with public advisory, communication strategy with linkedin post by oracle cso, communication strategy with mandiant technical alert, and enhanced monitoring with recommended for customers to detect prior compromise, and incident response plan activated with yes (oracle released patch and urged immediate installation), and third party assistance with google mandiant (investigation and advisory), and containment measures with patch release (cve-2025-61882), containment measures with indicators of compromise (iocs) shared with customers, and remediation measures with urgent patch installation recommended for all customers, and communication strategy with public security advisory by oracle cso rob duhart, communication strategy with linkedin post by google mandiant cto charles carmakal, and incident response plan activated with oracle security alert (urgent patching advisory), and third party assistance with crowdstrike (detection and analysis), third party assistance with mandiant (investigation), third party assistance with google threat intelligence group (gtig), and containment measures with patching cve-2025-61882, containment measures with disabling exposed ebs components, and communication strategy with oracle customer advisory, communication strategy with public disclosure of poc risks, and enhanced monitoring with recommended for oracle ebs environments, and incident response plan activated with yes (google and oracle), and third party assistance with google security researchers, and remediation measures with oracle security advisory issued, remediation measures with technical indicators shared by google for detection, and communication strategy with public advisory by oracle, communication strategy with blog post by google, communication strategy with media statements, and enhanced monitoring with recommended (google provided indicators for detection), and third party assistance with aha’s preferred cybersecurity provider program, third party assistance with microsoft (via rural health resiliency program), and and containment measures with immediate software patch installation (oracle’s e-business suite), containment measures with long-term cyber incident response planning, and remediation measures with cybersecurity assessments, remediation measures with cloud capability evaluations, remediation measures with curated cyber and ai training, remediation measures with foundational cyber certifications for it staff, and communication strategy with aha advisories with federal law enforcement input, communication strategy with public awareness campaigns (e.g., cybersecurity awareness month), and incident response plan activated with yes (oracle released emergency security alerts and patches), and third party assistance with google threat intelligence, third party assistance with mandiant, third party assistance with crowdstrike, and containment measures with emergency patching (cve-2025-61884 & cve-2025-61882), containment measures with urgent advisory for customers to apply updates, and remediation measures with patch deployment, remediation measures with mitigation guidance for unpatched systems, and communication strategy with public security advisories, communication strategy with direct customer notifications, and enhanced monitoring with recommended (oracle advised customers to monitor for exploitation attempts), and remediation measures with patch released in october 2025 security alert, and third party assistance with security researchers (the raven file), and remediation measures with oracle released patch in october 2025, and remediation measures with oracle released a security patch for the exploited vulnerability, and communication strategy with data breach notification letters mailed to impacted individuals, and communication strategy with public disclosure on official website, sec filing, notification letters to affected individuals, and communication strategy with written notice to affected individuals on dec. 22, 2025..
Incident Details
Can you provide details on each incident ?
Title: Oracle MICROS Point-of-Sale System Breach
Description: A Russian cybercrime group breached 100 computer systems belonging to Oracle's retail division and MICROS point-of-sale credit card payment systems. It did not expose corporate networks and other cloud and service offerings that were not affected by the breach. Oracle urged Micros customers to change their passwords and any passwords used by Micros representatives to access their on-premise systems.
Type: Data Breach
Attack Vector: Network Intrusion
Threat Actor: Russian Cybercrime Group
Title: Alleged Data Breach at Oracle Cloud
Description: Oracle recently faced allegations of a data breach, with a threat actor claiming to have stolen 6 million records from Oracle Cloud's SSO login servers. Oracle has denied any breach, stating there was no compromise of their cloud services and customers' data remained secure. The threat actor, rose87168, attempted to sell the data and claimed the information includes SSO passwords, Java Keystore files, key files, and JPS keys from Oracle Cloud servers. Despite encrypted and hashed passwords requiring decryption or cracking, the impact of such a breach—if proven accurate—could potentially be significant, undermining trust in Oracle's cloud security and potentially impacting customers whose data was compromised.
Type: Data Breach
Threat Actor: rose87168
Motivation: Financial Gain
Title: Cyberattack on Oracle Cloud by 'rose87168'
Description: The cyberattack on Oracle Cloud orchestrated by 'rose87168' led to the theft of 6 million records potentially affecting over 140,000 tenants. Exfiltrated data includes sensitive JKS files, encrypted SSO passwords, key files, and JPS keys. This information is now sold on dark web forums. The breach, exploiting CVE-2021-35587, poses risks of unauthorized access and corporate espionage given the type of data stolen. Oracle's compromised subdomain and vulnerable software version highlight security gaps and raise concerns of lateral movement within the cloud environment.
Type: Data Breach
Attack Vector: Exploitation of CVE-2021-35587
Vulnerability Exploited: CVE-2021-35587
Threat Actor: 'rose87168'
Motivation: Unauthorized accessCorporate espionage
Title: Data Breach at Oracle Health
Description: A breach at Oracle Health has resulted in the theft of patient data from legacy servers impacting multiple US healthcare organizations and hospitals. Unauthorized access by a threat actor after January 22, 2025, led to the exfiltration of Electronic Health Records (EHR) data with potential violations of HIPAA laws. There is uncertainty whether ransomware was involved, but Oracle Health's response has been criticized for lack of transparency and failure to provide proper guidance and documentation, leaving hospitals to navigate the aftermath themselves.
Type: Data Breach
Attack Vector: Unauthorized Access
Title: Oracle Health Data Breach
Description: Oracle Health, the healthcare subsidiary of Oracle Corporation, experienced a data breach involving legacy Cerner data migration servers. This incident, which Oracle has communicated to its customers through private letters, is reported to have potentially exposed sensitive customer data. The breach is a consequence of Oracle's acquisition of Cerner Corp, a notable electronic health records business, as Oracle aimed to transition the healthcare software to cloud infrastructure. The significance of the data involved and the potential ramifications of such breaches in the healthcare sector underline the serious nature of this cybersecurity event.
Type: Data Breach
Title: Oracle Data Security Incidents
Description: Oracle faced two data security incidents with reported poor incident communication. An attacker allegedly accessed login servers and legacy Cerner data, leading to customers' personal information being at risk. Missteps in Oracle's response include outright denial, potentially misleading statements, and accusations of deleting evidence online, compounding the damage to their reputation.
Type: Data Breach
Attack Vector: Login Server AccessLegacy Cerner Data Access
Title: Oracle Corporation Gen 1 Servers Data Breach
Description: Oracle Corporation endured a data breach affecting its Gen 1 servers, with no complete PII exposure but involving 6 million data records including usernames, email addresses, and hashed passwords. Sensitive credentials related to SSO and LDAP were also compromised. The breach, attributed to the threat actor 'rose87168' via a 2020 Java exploit, resulted in the theft of JKS files and Enterprise Manager JPS keys from legacy systems approximately 16 months old. Oracle has informed clients and taken steps to bolster Gen 1 server security while maintaining that its Gen 2 servers and primary Oracle Cloud infrastructure remain secure.
Type: Data Breach
Attack Vector: 2020 Java Exploit
Vulnerability Exploited: Java Vulnerability
Threat Actor: rose87168
Title: Fidelity Investments Data Breach (2013) Affecting Oracle Corporation Employees
Description: The California Office of the Attorney General reported a data breach involving Fidelity Investments on July 31, 2013. The breach occurred on July 10, 2013, when an unauthorized individual accessed a report that included personal information of Oracle Corporation employees, such as names and Social Security numbers. The total number of individuals affected is unknown.
Date Detected: 2013-07-10
Date Publicly Disclosed: 2013-07-31
Type: Data Breach
Threat Actor: Unauthorized Individual
Title: Large-Scale Phishing Operation Targeting Hospitality Industry via Malvertising
Description: A sophisticated phishing campaign is targeting the hospitality industry through malicious search engine advertisements (malvertising). Cybercriminals impersonate at least thirteen hotel and vacation rental service providers (including Oracle Hospitality and Airbnb) to steal credentials and breach cloud-based property management systems. The operation employs typosquatted domains, fake login pages, and advanced tactics to bypass multi-factor authentication (MFA), including real-time capture of one-time passwords (OTP) and SMS/email codes. Technical analysis suggests Russian-speaking threat actors, with infrastructure leveraging Russian datacenter proxies and beaconing techniques for victim tracking. The campaign poses significant risks to guest data, payment information, and operational systems across the sector.
Type: phishing
Attack Vector: malicious advertisements (malvertising)typosquatted domainsfake login pagessocial engineering
Vulnerability Exploited: human trust in search engine adslack of phishing-resistant authenticationweak MFA implementations
Threat Actor: Russian-speaking cybercriminalsunknown APT/group (potential initial access brokers)
Motivation: financial gaindata theftfraud (e.g., unauthorized bookings)sale of credentials on dark web
Title: Extortion Campaign Targeting Oracle E-Business Suite Systems
Description: Mandiant and Google are tracking a new extortion campaign where executives at multiple companies received emails claiming that sensitive data was stolen from their Oracle E-Business Suite systems. The campaign began in late September 2025, with extortion emails sent from hundreds of compromised accounts, some linked to the FIN11 threat group (associated with Clop ransomware). The emails contain contact addresses listed on Clop's data leak site, but there is insufficient evidence to confirm if data was actually stolen. Organizations are advised to investigate their Oracle E-Business Suite environments for unusual access or compromise.
Date Detected: 2025-09-29
Date Publicly Disclosed: 2025-09-29
Type: Extortion
Attack Vector: Compromised Email AccountsPotential Zero-Day Exploitation (Oracle E-Business Suite)
Threat Actor: FIN11 (suspected)Clop Ransomware Gang (potential link)
Motivation: Financial Gain (Extortion)
Title: Clop Ransomware Gang Targets Oracle E-Business Suite in Extortion Campaign
Description: Hackers possibly connected to the Russian ransomware gang Clop (FIN11) are attempting to extort corporate executives by threatening to leak sensitive information allegedly stolen through Oracle's E-Business Suite. The campaign, tracked by Mandiant and Google Threat Intelligence Group (GTIG), involves extortion emails sent from compromised accounts, with claims of data theft from Oracle’s widely used business platform. The group has historically exploited vulnerabilities in file transfer tools (e.g., MOVEit, GoAnywhere) to steal and sell data for ransom. Investigations are ongoing, and the veracity of the claims remains unconfirmed.
Date Detected: 2023-09-29
Date Publicly Disclosed: 2023-10-04
Type: Data Breach
Attack Vector: Phishing/Spoofed EmailsExploitation of Vulnerabilities in Oracle E-Business SuiteCompromised Accounts
Threat Actor: Clop (FIN11)Potentially Impersonating Clop
Motivation: Financial Gain (Extortion/Ransom)
Title: Critical Zero-Day Exploit in Oracle E-Business Suite (CVE-2025-61882) Linked to Cl0p Ransomware Attacks
Description: Oracle released an emergency update to patch a critical zero-day vulnerability (CVE-2025-61882, CVSS 9.8) in its E-Business Suite, actively exploited by the Cl0p ransomware group in a high-volume data theft campaign. The flaw allows unauthenticated remote code execution via HTTP in the Oracle Concurrent Processing component. Indicators of compromise (IoCs) suggest involvement of the Scattered LAPSUS$ Hunters group, with evidence of exploit PoCs and malicious IP activity. Mandiant reported the campaign as part of a broader wave of attacks targeting Oracle EBS vulnerabilities, including those patched in July 2025 and the newly disclosed zero-day.
Date Detected: 2025-08
Date Publicly Disclosed: 2025-08
Type: Data Breach
Attack Vector: Network-based (HTTP)Unauthenticated Remote Code Execution
Vulnerability Exploited: CVE-2025-61882 (CVSS 9.8) - Oracle E-Business Suite Concurrent Processing Component
Threat Actor: Cl0p Ransomware GroupScattered LAPSUS$ Hunters
Motivation: Data TheftFinancial Gain (Ransomware)Exploitation of Zero-Day for Mass Compromise
Title: Oracle E-Business Suite Zero-Day Vulnerability Exploitation by Clop Hacking Group
Description: Oracle has patched a zero-day vulnerability (CVE-2025-61882) in its Oracle E-Business Suite, which the Clop hacking group is actively exploiting to steal personal information about corporate executives. The vulnerability allows exploitation over a network without authentication. Oracle urged customers to install the patch immediately, as thousands of organizations globally use the E-Business Suite for critical operations, including storing customer and HR data. The Clop group has been sending extortion emails to executives since late September 2025, demanding ransom payments to prevent the publication of stolen personal data. The exploitation campaign began in August 2025, following Oracle's July patches for previously identified vulnerabilities.
Date Detected: 2025-08-01
Date Publicly Disclosed: 2025-10-02
Type: Data Breach
Attack Vector: Network-based exploitation (no authentication required)Extortion emails
Vulnerability Exploited: CVE-2025-61882 (Zero-day in Oracle E-Business Suite)
Threat Actor: Clop (hacking group linked to ransomware and extortion)
Motivation: Financial gain (extortion)Data theft
Title: Clop Ransomware Exploits Oracle E-Business Suite Zero-Day (CVE-2025-61882) in Data Theft Attacks
Description: The Clop ransomware gang has been exploiting a critical Oracle E-Business Suite (EBS) zero-day bug (CVE-2025-61882) in data theft attacks since at least early August 2025. The vulnerability, patched by Oracle in early October 2025, resides in the BI Publisher Integration component of Oracle EBS's Concurrent Processing, allowing unauthenticated remote code execution (RCE) via a single HTTP request. Clop has been using this flaw to steal sensitive documents and extort victims via email campaigns. Other threat actors, including GRACEFUL SPIDER, may also be involved. Oracle has urged customers to patch immediately, as the public disclosure of the PoC exploit is expected to escalate attacks.
Date Detected: 2025-08-09
Date Publicly Disclosed: 2025-10-03
Type: Data Theft
Attack Vector: Unauthenticated Remote Code Execution (RCE)HTTP Request ExploitationEmail-Based Extortion
Vulnerability Exploited: CVE-2025-61882 (Oracle E-Business Suite BI Publisher Integration Component)
Threat Actor: Clop Ransomware GangGRACEFUL SPIDER (moderate confidence)
Motivation: Financial Gain (Extortion)Data Theft for Leverage
Title: Clop Extortion Gang Exploits Zero-Day in Oracle E-Business Suite to Steal Corporate Data
Description: Security researchers at Google reported that the Clop extortion gang exploited multiple security vulnerabilities, including a zero-day bug, in Oracle’s E-Business Suite software to steal significant amounts of data from dozens of organizations. The campaign, active since at least July 10, targeted corporate executives and involved extortion emails. Oracle initially claimed the vulnerabilities were patched in July, but later confirmed the zero-day could be exploited remotely without credentials. The Clop gang, linked to Russia, is known for mass-hacking campaigns exploiting unknown vulnerabilities in managed file transfer tools and enterprise software.
Date Detected: 2023-10-05T00:00:00Z
Date Publicly Disclosed: 2023-10-05T00:00:00Z
Type: Data Breach
Attack Vector: Exploitation of Zero-Day Vulnerability (CVE Unknown)Network-Based Attack (No Credentials Required)Extortion Emails
Vulnerability Exploited: Zero-Day in Oracle E-Business SuitePreviously Patched Vulnerabilities (Exploited Post-Patch)
Threat Actor: Clop Ransomware/Extortion Gang
Motivation: Financial Gain (Extortion)Data Theft for Dark Web Sale
Title: Critical Vulnerability in Oracle’s E-Business Suite Exploited for Data Theft and Ransomware Attacks in Healthcare Sector
Description: The FBI issued an urgent warning about a critical vulnerability in Oracle’s E-Business Suite, enabling cybercriminals to conduct data theft and ransomware attacks. The vulnerability, described as a 'stop-what-you’re-doing and patch immediately' issue, poses significant risks to healthcare organizations, including hospitals. Oracle has released a patch to mitigate the threat. The healthcare sector, a long-standing top target for cyberattacks, faces escalating threats from sophisticated criminal and nation-state actors. These attacks disrupt patient care, encrypt systems, and compromise sensitive data. The American Hospital Association (AHA) emphasizes the need for a whole-of-government approach to counter these threats, including federal intervention, threat intelligence sharing, and offensive cyber capabilities. The AHA provides resources, partnerships, and advisory services to help hospitals bolster their cybersecurity defenses, particularly for under-resourced rural facilities.
Type: Data Theft
Attack Vector: Exploitation of Critical Vulnerability in Oracle’s E-Business Suite
Vulnerability Exploited: Critical Security Vulnerability in Oracle’s E-Business Suite (Patch Available)
Threat Actor: Sophisticated CybercriminalsNation-State Sponsored Actors
Motivation: Financial GainDisruption of Healthcare ServicesData Theft
Title: Oracle E-Business Suite Vulnerabilities (CVE-2025-61884 & CVE-2025-61882) Exploited in Extortion Campaigns
Description: Oracle issued emergency security updates to address critical vulnerabilities (CVE-2025-61884 and CVE-2025-61882) in its E-Business Suite (EBS). The flaws, exploitable remotely without authentication, were linked to extortion campaigns by the Cl0p ransomware group (FIN11). Attackers exploited these vulnerabilities to steal sensitive data, send extortion emails to executives, and potentially gain control of Oracle Concurrent Processing components. Oracle urged immediate patching to mitigate risks, while Google Mandiant and CrowdStrike attributed the attacks to Cl0p with moderate confidence. A proof-of-concept (POC) exploit was disclosed on October 3, 2025, increasing the likelihood of further exploitation by threat actors.
Date Detected: 2025-07-10
Date Publicly Disclosed: 2025-10-14
Type: Vulnerability Exploitation
Attack Vector: NetworkHTTPExploitation of Public-Facing Application
Vulnerability Exploited: CVE-2025-61884 (CVSS 7.5 - Information Disclosure in Runtime UI)CVE-2025-61882 (CVSS 9.8 - Remote Code Execution in BI Publisher Integration/Concurrent Processing)
Threat Actor: Cl0p Ransomware Group (Graceful Spider)FIN11Potential involvement of Scattered Spider, Slippy Spider (Lapsus$), ShinyHunters
Motivation: Financial GainData TheftExtortion
Title: Clop Ransomware Exploits Zero-Day CVE-2025-61882 in Oracle E-Business Suite
Description: The Clop ransomware gang (Graceful Spider) breached Oracle Corporation's internal systems by exploiting a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite (EBS). The unauthenticated remote code execution (RCE) flaw allowed attackers to bypass authentication via the OA_HTML/SyncServlet endpoint and inject malicious XSLT templates via OA_HTML/RF.jsp, granting full control over ERP data. The attack, part of a broader supply chain campaign, targeted Oracle and other major entities like Mazda, Humana, and the Washington Post. Clop listed Oracle on its dark web leak site, threatening to release financial and personal records unless ransom demands were met. Evidence links the attack infrastructure to prior MOVEit exploits (CVE-2023-34362), with 96 distinct IPs identified, primarily hosted on Russian-based providers.
Date Detected: 2025-06
Date Publicly Disclosed: 2025-10
Type: Ransomware
Attack Vector: Unauthenticated Remote Code Execution (RCE)Authentication Bypass via SyncServletXSLT Injection via RF.jsp
Vulnerability Exploited: CVE-2025-61882 (Critical, CVSS 9.8)
Threat Actor: Clop Ransomware Gang (Graceful Spider)
Motivation: Financial GainData Extortion
Title: Clop Ransomware Gang Exploits Zero-Day Vulnerability in Oracle E-Business Suite (CVE-2025-61882)
Description: The Clop ransomware gang (Graceful Spider) claimed to have breached Oracle Corporation’s internal systems by exploiting a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite (EBS). The unauthenticated remote code execution (RCE) flaw, with a CVSS score of 9.8, was actively exploited since August 2025, two months before Oracle released a patch in October 2025. The attack leveraged the OA_HTML/SyncServlet endpoint for authentication bypass and malicious XSLT injection via OA_HTML/RF.jsp. Clop listed Oracle and high-profile customers (e.g., Mazda, Humana, Washington Post) on its dark web leak site, threatening data exposure unless ransom demands were met. Evidence suggests Oracle may have been compromised via its own unpatched EBS software, risking exposure of internal corporate and customer data.
Date Detected: 2025-08
Type: Ransomware Attack
Attack Vector: Unauthenticated Remote Code Execution (RCE)Authentication Bypass via SyncServletXSLT Injection via RF.jsp
Vulnerability Exploited: Cve Id: CVE-2025-61882, Affected Product: Oracle E-Business Suite (Versions 12.2.3 – 12.2.14), Vulnerability Type: Unauthenticated Remote Code Execution (RCE), Cvss Score: 9.8, Authentication BypassXSLT InjectionPatch Status: Patched in October 2025 (exploited since August 2025).
Threat Actor: Name: ['Clop Ransomware Gang', 'Graceful Spider']Origin: Russian-linkedConfirmed Victims: 1025Ransom Extracted: $500 million (since 2019)Associated Infrastructure: {'ip_addresses': 96, 'reused_ips_from_moveit': 41, 'geographic_distribution': [{'country': 'Germany', 'ip_count': 16}, {'country': 'Brazil', 'ip_count': 13}, {'country': 'Panama', 'ip_count': 12}], 'service_providers': ['Russian-based']}
Motivation: Financial GainData ExtortionReputation Damage
Title: Cyber Attacks on Elite US Universities
Description: Hackers have struck elite US universities in recent weeks, pilfering sensitive data from donors and making off with students’ information in a string of digital heists. Dartmouth College, Harvard University, Princeton, and the University of Pennsylvania have each disclosed breaches within the past three weeks. The identity of the intruders in most of the recent incidents remains a mystery. The hackers typically duped school employees to access databases of personal information about prominent individuals associated with each institution.
Date Detected: 2023-11-18
Type: Data Breach
Attack Vector: PhishingSoftware Vulnerability Exploitation
Vulnerability Exploited: Oracle Corp. product vulnerability
Motivation: Financial GainEspionage
Title: Parexel Data Breach Involving Sensitive Personal Information
Description: Parexel reported a data breach where sensitive personal identifiable information in its Oracle OCI E-Business Suite environment may have been compromised. An unauthorized third party accessed the data, leading to the exposure of personal and financial information of employees.
Date Detected: 2025-10-04
Date Publicly Disclosed: 2025-12-17
Type: Data Breach
Threat Actor: Unauthorized third party
Title: Clop Ransomware Gang Steals Data of 3.5 Million University of Phoenix Students and Staff
Description: The Clop ransomware gang has stolen the data of nearly 3.5 million University of Phoenix (UoPX) students, staff, and suppliers after breaching the university's network in August 2025. The attackers exploited a zero-day vulnerability in the Oracle E-Business Suite (EBS) financial application to steal sensitive personal and financial information.
Date Detected: 2025-11-21
Date Publicly Disclosed: 2025-12-01
Type: Data Breach, Ransomware
Attack Vector: Exploitation of zero-day vulnerability (CVE-2025-61882)
Vulnerability Exploited: CVE-2025-61882 (Oracle E-Business Suite)
Threat Actor: Clop ransomware gang
Motivation: Extortion, Data Theft
Title: University of Phoenix Data Breach
Description: In November 2025, University of Phoenix discovered a major data breach that may have affected millions of current and former students and staff. A vulnerability in Oracle E-Business Suite software was exploited by the CL0P ransomware group between Aug. 13 and Aug. 22, 2025, resulting in the exfiltration of sensitive data.
Date Detected: 2025-11-21
Date Publicly Disclosed: 2025-12-21
Type: Data Breach
Attack Vector: Exploitation of software vulnerability
Vulnerability Exploited: Oracle E-Business Suite software vulnerability
Threat Actor: CL0P ransomware group
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Breach.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through CVE-2021-35587, malvertising (malicious search engine ads)typosquatted domains, Compromised Email Accounts, Compromised Email AccountsPotential Exploitation of Oracle E-Business Suite Vulnerabilities, Oracle E-Business Suite Concurrent Processing Component (via HTTP), CVE-2025-61882 (Oracle E-Business Suite zero-day), CVE-2025-61882 (Oracle EBS BI Publisher), Zero-Day Vulnerability in Oracle E-Business Suite (Network-Based, No Authentication Required), Exploitation of Unpatched Vulnerability in Oracle’s E-Business Suite, Exploitation of Oracle EBS Vulnerabilities (CVE-2025-61882, CVE-2025-61884)Hacked User EmailsDefault Password Reset Mechanisms, OA_HTML/SyncServlet (Authentication Bypass) & OA_HTML/RF.jsp (XSLT Injection), Oracle E-Business Suite (EBS) SyncServlet endpoint, Phishing (duping school employees) and Oracle E-Business Suite (EBS) zero-day vulnerability (CVE-2025-61882).
Impact of the Incidents
What was the impact of each incident ?
Incident : Data Breach ORA392622
Data Compromised: Credit card payment information
Systems Affected: MICROS Point-of-Sale Systems
Payment Information Risk: True
Incident : Data Breach ORA344032125
Data Compromised: Sso passwords, Java keystore files, Key files, Jps keys
Systems Affected: Oracle Cloud SSO login servers
Brand Reputation Impact: Potential undermining of trust in Oracle's cloud security
Incident : Data Breach ORA615032225
Data Compromised: Jks files, Encrypted sso passwords, Key files, Jps keys
Incident : Data Breach ORA526032825
Data Compromised: Electronic health records (ehr)
Systems Affected: Legacy Servers
Legal Liabilities: Potential HIPAA violations
Incident : Data Breach ORA455040125
Systems Affected: legacy Cerner data migration servers
Incident : Data Breach ORA656040225
Data Compromised: Personal Information
Systems Affected: Login ServersLegacy Cerner Data
Brand Reputation Impact: Damaged Reputation
Incident : Data Breach ORA956040325
Data Compromised: Usernames, Email addresses, Hashed passwords, Sso credentials, Ldap credentials, Jks files, Enterprise manager jps keys
Systems Affected: Gen 1 serverslegacy systems
Incident : Data Breach ORA720082025
Data Compromised: Names, Social security numbers
Identity Theft Risk: High (PII exposed)
Incident : phishing ORA805090225
Data Compromised: Guest personal information, Payment data, Booking system credentials, Operational data
Systems Affected: cloud-based property management systemsguest messaging platformsauthentication systems
Operational Impact: potential unauthorized access to booking systemsreputation damagecustomer trust erosion
Brand Reputation Impact: high (due to impersonation of major brands like Oracle Hospitality and Airbnb)
Identity Theft Risk: ['high (guest PII and payment data exposed)']
Payment Information Risk: ['high (credit card details and transaction data at risk)']
Incident : Extortion ORA4062140100225
Systems Affected: Oracle E-Business Suite (potential)
Brand Reputation Impact: Potential (due to extortion claims)
Incident : Data Breach ORA1092210100225
Data Compromised: Potentially finance, hr, and supply chain data (oracle e-business suite)
Systems Affected: Oracle E-Business Suite
Brand Reputation Impact: High (Potential Reputation Damage Due to Extortion Threats)
Identity Theft Risk: Potential (If PII Stolen)
Incident : Data Breach ORA5662156100625
Data Compromised: Large amounts of data (exact scope undisclosed)
Systems Affected: Oracle E-Business Suite (Concurrent Processing Component)
Brand Reputation Impact: High (due to zero-day exploitation and association with Cl0p ransomware)
Identity Theft Risk: Potential (depends on stolen data types)
Incident : Data Breach ORA4993249100625
Data Compromised: Personal information of corporate executives, Customer data, Employee hr files
Systems Affected: Oracle E-Business Suite
Brand Reputation Impact: High (extortion campaign targeting executives, potential data leaks)
Identity Theft Risk: High (personal information of executives targeted)
Incident : Data Theft ORA1692116100725
Data Compromised: Sensitive documents, Potentially pii or corporate data
Systems Affected: Oracle E-Business Suite (EBS) with unpatched BI Publisher Integration
Brand Reputation Impact: High (due to extortion and potential data leaks)
Identity Theft Risk: ['Potential (if PII was stolen)']
Incident : Data Breach ORA4202442101025
Data Compromised: Corporate executive data, Customer data, Employee hr files, Sensitive corporate data
Systems Affected: Oracle E-Business Suite
Brand Reputation Impact: High (Associated with Mass Hacking Campaign)
Identity Theft Risk: High (Personal Information of Executives Compromised)
Incident : Data Theft ORA4092340101025
Downtime: True
Operational Impact: Disruption of Patient Care, Delay in Clinical Operations, Potential Shutdown of Vital Systems
Brand Reputation Impact: Potential Erosion of Trust in Healthcare Providers Due to Data Breaches and Service Disruptions
Identity Theft Risk: True
Incident : Vulnerability Exploitation ORA0832608101425
Data Compromised: Sensitive resources, Potential oracle e-business suite data (as claimed in extortion emails)
Systems Affected: Oracle E-Business Suite (Versions 12.2.3–12.2.14)Runtime UI ComponentBI Publisher IntegrationConcurrent Processing Component
Operational Impact: Potential Disruption Due to Unauthorized AccessEmergency Patching Requirements
Brand Reputation Impact: Potential Reputation Damage Due to Data Theft Claims and Extortion Campaigns
Identity Theft Risk: ['High (Due to Potential Exposure of Sensitive Data)']
Incident : Ransomware ORA4332743112125
Data Compromised: Financial records, Personal records, Erp data
Systems Affected: Oracle E-Business Suite (Versions 12.2.3–12.2.14)Internal Corporate Systems
Operational Impact: Potential disruption to order management, procurement, and logistics functions
Brand Reputation Impact: High (public listing on dark web leak site)
Identity Theft Risk: High (personal records exposed)
Incident : Ransomware Attack ORA5233252112125
Data Compromised: Internal corporate data, Customer information, Financial records, Personal data
Systems Affected: Oracle E-Business Suite (EBS) ServersEnterprise Resource Planning (ERP) Systems
Operational Impact: Potential disruption to order management, procurement, and logistics
Brand Reputation Impact: High (public listing on dark web leak site)
Identity Theft Risk: ['High (PII exposure risk)']
Incident : Data Breach PRIHARDARCOLORA1765173096
Data Compromised: Personal data of donors, students, and prominent individuals
Brand Reputation Impact: High
Identity Theft Risk: High
Incident : Data Breach ORAPAR1766015901
Data Compromised: Sensitive personal identifiable information
Systems Affected: Oracle OCI E-Business Suite (Oracle EBS)
Identity Theft Risk: High
Payment Information Risk: High
Incident : Data Breach, Ransomware PRIORAUNI1766419165
Data Compromised: 3,489,274 records
Systems Affected: Oracle E-Business Suite (EBS) financial application
Brand Reputation Impact: Yes
Legal Liabilities: Potential regulatory fines and legal actions
Identity Theft Risk: Yes
Payment Information Risk: Yes
Incident : Data Breach ORA1766435444
Data Compromised: Sensitive personally identifiable information
Systems Affected: Oracle E-Business Suite
Identity Theft Risk: High
Payment Information Risk: High
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Credit Card Payment Information, , Sso Passwords, Java Keystore Files, Key Files, Jps Keys, , Jks Files, Encrypted Sso Passwords, Key Files, Jps Keys, , Electronic Health Records (Ehr), , Sensitive Customer Data, , Personal Information, Usernames, Email Addresses, Hashed Passwords, Sso Credentials, Ldap Credentials, Jks Files, Enterprise Manager Jps Keys, , Personally Identifiable Information (Pii), , Credentials (Usernames, Passwords), Pii (Email Addresses, Phone Numbers), Guest Data, Payment Information, Booking Details, , Potentially Finance, Hr, Supply Chain Data, Client Credentials (From January Incident), , Personal Information (Executives), Customer Data, Employee Hr Files, , Sensitive Corporate Documents, Potentially Pii, , Personally Identifiable Information (Pii) Of Executives, Customer Data, Employee Hr Files, Corporate Sensitive Data, , Patient Personal Data, Potentially Sensitive Healthcare Information, , Sensitive Resources, Potentially Oracle Ebs Data (As Per Extortion Claims), , Financial Records, Personal Records, Erp Data, , Corporate Internal Data, Customer Information, Financial Records, Personal Data, , Personal Information, Donor Data, Student Information, , Name, Social Security Number, Date Of Birth, Financial Account Number, Payment Card Number (Without Cvv), National Id Number, , Personal Information, Financial Information, , Names, Dates Of Birth, Social Security Numbers, Bank Account Numbers, Bank Routing Numbers and .
Which entities were affected by each incident ?
Incident : Data Breach ORA615032225
Entity Name: Oracle Cloud
Entity Type: Cloud Service Provider
Industry: Technology
Customers Affected: 140,000 tenants
Incident : Data Breach ORA526032825
Entity Name: Oracle Health
Entity Type: Healthcare Technology Company
Industry: Healthcare
Location: United States
Customers Affected: Multiple US healthcare organizations and hospitals
Incident : Data Breach ORA455040125
Entity Name: Oracle Health
Entity Type: Company
Industry: Healthcare
Incident : Data Breach ORA956040325
Entity Name: Oracle Corporation
Entity Type: Corporation
Industry: Technology
Incident : Data Breach ORA720082025
Entity Name: Fidelity Investments
Entity Type: Financial Services
Industry: Investment Management
Location: United States
Incident : Data Breach ORA720082025
Entity Name: Oracle Corporation
Entity Type: Corporation
Industry: Technology
Location: United States
Customers Affected: Unknown (employees affected)
Incident : phishing ORA805090225
Entity Name: Oracle Hospitality
Entity Type: technology provider
Industry: hospitality
Location: global
Size: large enterprise
Incident : phishing ORA805090225
Entity Name: Airbnb
Entity Type: vacation rental platform
Industry: hospitality
Location: global
Size: large enterprise
Incident : phishing ORA805090225
Entity Name: Unnamed hotel and vacation rental providers (11+ others)
Entity Type: hotel chains, property management companies, vacation rental services
Industry: hospitality
Location: global
Incident : Extortion ORA4062140100225
Entity Type: Multiple Companies (Executives Targeted)
Incident : Data Breach ORA1092210100225
Entity Name: Oracle (Primary Target)
Entity Type: Corporation
Industry: Technology/Enterprise Software
Location: Global (HQ: Redwood Shores, California, USA)
Size: Large (Fortune 100)
Customers Affected: Numerous Organizations (Exact Number Undisclosed)
Incident : Data Breach ORA5662156100625
Entity Name: Oracle Corporation
Entity Type: Technology Vendor
Industry: Enterprise Software
Location: Global (HQ: Redwood City, California, USA)
Size: Large (Multinational)
Customers Affected: Multiple (exact number undisclosed)
Incident : Data Breach ORA4993249100625
Entity Name: Oracle Corporation
Entity Type: Technology Company
Industry: Enterprise Software
Location: Global (HQ: Redwood Shores, California, USA)
Size: Large (thousands of organizations use Oracle E-Business Suite)
Customers Affected: Multiple (exact number unspecified, includes corporate executives)
Incident : Data Theft ORA1692116100725
Entity Name: Multiple Organizations Using Oracle E-Business Suite
Entity Type: Corporations, Enterprises
Location: Global (targeting internet-exposed EBS applications)
Incident : Data Breach ORA4202442101025
Entity Name: Oracle Corporation
Entity Type: Software Vendor
Industry: Technology
Location: Redwood City, California, USA
Size: Large Enterprise
Customers Affected: Dozens of Organizations (Exact Number Undisclosed)
Incident : Data Theft ORA4092340101025
Entity Name: Hospitals and Health Systems (General)
Entity Type: Healthcare Provider
Industry: Healthcare
Location: United States (Nationwide)
Incident : Data Theft ORA4092340101025
Entity Name: Rural Hospitals (Including Critical Access Hospitals and Rural Emergency Hospitals)
Entity Type: Healthcare Provider
Industry: Healthcare
Location: United States (Rural Areas)
Size: Small to Medium
Incident : Vulnerability Exploitation ORA0832608101425
Entity Name: Oracle Corporation
Entity Type: Software Vendor
Industry: Technology
Location: Global (HQ: Redwood City, California, USA)
Size: Large Enterprise
Customers Affected: Multiple (Exact Number Unspecified)
Incident : Vulnerability Exploitation ORA0832608101425
Entity Name: Unspecified Organizations Using Oracle E-Business Suite
Entity Type: Enterprises, Government Agencies, Potential High-Value Targets
Location: Global
Incident : Ransomware ORA4332743112125
Entity Name: Oracle Corporation
Entity Type: Technology Vendor
Industry: Enterprise Software
Location: United States
Size: Large (Multinational)
Incident : Ransomware ORA4332743112125
Entity Name: MAZDA.COM
Entity Type: Corporate
Industry: Automotive
Incident : Ransomware ORA4332743112125
Entity Name: HUMANA.COM
Entity Type: Corporate
Industry: Healthcare Insurance
Incident : Ransomware ORA4332743112125
Entity Name: Washington Post
Entity Type: Media
Industry: News/Publishing
Incident : Ransomware Attack ORA5233252112125
Entity Name: Oracle Corporation
Entity Type: Technology Vendor
Industry: Enterprise Software
Location: Global (HQ: Redwood City, California, USA)
Size: Large (Multinational)
Customers Affected: Potentially high (internal systems + customers using EBS)
Incident : Ransomware Attack ORA5233252112125
Entity Name: Mazda
Entity Type: Corporation
Industry: Automotive
Location: Global
Incident : Ransomware Attack ORA5233252112125
Entity Name: Humana
Entity Type: Corporation
Industry: Healthcare Insurance
Location: USA
Incident : Ransomware Attack ORA5233252112125
Entity Name: The Washington Post
Entity Type: Media Organization
Industry: News/Publishing
Location: USA
Incident : Data Breach PRIHARDARCOLORA1765173096
Entity Name: Dartmouth College
Entity Type: University
Industry: Education
Location: United States
Customers Affected: Donors and students
Incident : Data Breach PRIHARDARCOLORA1765173096
Entity Name: Harvard University
Entity Type: University
Industry: Education
Location: United States
Customers Affected: Fundraisers and prominent individuals
Incident : Data Breach PRIHARDARCOLORA1765173096
Entity Name: Princeton University
Entity Type: University
Industry: Education
Location: United States
Incident : Data Breach PRIHARDARCOLORA1765173096
Entity Name: University of Pennsylvania
Entity Type: University
Industry: Education
Location: United States
Incident : Data Breach PRIHARDARCOLORA1765173096
Entity Name: Columbia University
Entity Type: University
Industry: Education
Location: United States
Incident : Data Breach ORAPAR1766015901
Entity Name: Parexel
Entity Type: Company
Industry: Clinical Research, Pharmaceutical
Customers Affected: Employees
Incident : Data Breach, Ransomware PRIORAUNI1766419165
Entity Name: University of Phoenix
Entity Type: Educational Institution
Industry: Higher Education
Location: Phoenix, Arizona, USA
Size: Over 100,000 enrolled students and nearly 3,000 academic staff
Customers Affected: 3,489,274 (current and former students, employees, faculty, and suppliers)
Incident : Data Breach ORA1766435444
Entity Name: University of Phoenix
Entity Type: Educational Institution
Industry: Higher Education
Location: Phoenix, Arizona, USA
Size: Large
Customers Affected: 3,489,274
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Data Breach ORA392622
Containment Measures: Password Change Recommendation
Communication Strategy: Customer Advisory
Incident : Data Breach ORA526032825
Communication Strategy: Criticized for lack of transparency
Incident : Data Breach ORA455040125
Communication Strategy: Private letters to customers
Incident : Data Breach ORA656040225
Communication Strategy: Outright DenialPotentially Misleading StatementsAccusations of Deleting Evidence Online
Incident : Data Breach ORA956040325
Remediation Measures: Informed clientsBolstered Gen 1 server security
Incident : Data Breach ORA720082025
Law Enforcement Notified: Yes (California Office of the Attorney General)
Incident : phishing ORA805090225
Third Party Assistance: Okta Threat Intelligence (Analysis By Moussa Diallo).
Containment Measures: monitoring for suspicious domain registrationsblocking known malicious domains
Remediation Measures: implementation of phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn)adaptive risk assessments for unusual access patterns
Communication Strategy: customer advisories about impersonation attemptsindustry-wide alerts
Enhanced Monitoring: real-time tracking of typosquatted domainsbeaconing detection
Incident : Extortion ORA4062140100225
Incident Response Plan Activated: Recommended (investigate Oracle E-Business Suite environments)
Third Party Assistance: Mandiant (Google Cloud), Gtig.
Enhanced Monitoring: Recommended (for unusual access)
Incident : Data Breach ORA1092210100225
Incident Response Plan Activated: True
Third Party Assistance: Mandiant (Google Cloud), Google Threat Intelligence Group (Gtig).
Communication Strategy: Public Warning via Cybersecurity Firms (Mandiant, GTIG)Media Outreach (Recorded Future News)
Incident : Data Breach ORA5662156100625
Incident Response Plan Activated: True
Third Party Assistance: Mandiant (Google Cloud).
Containment Measures: Emergency Patch Release (CVE-2025-61882)Advisory for Customer Mitigation
Remediation Measures: Patch ApplicationInvestigation into Potential Prior Compromise
Communication Strategy: Public AdvisoryLinkedIn Post by Oracle CSOMandiant Technical Alert
Enhanced Monitoring: Recommended for customers to detect prior compromise
Incident : Data Breach ORA4993249100625
Incident Response Plan Activated: Yes (Oracle released patch and urged immediate installation)
Third Party Assistance: Google Mandiant (Investigation And Advisory).
Containment Measures: Patch release (CVE-2025-61882)Indicators of Compromise (IoCs) shared with customers
Remediation Measures: Urgent patch installation recommended for all customers
Communication Strategy: Public security advisory by Oracle CSO Rob DuhartLinkedIn post by Google Mandiant CTO Charles Carmakal
Incident : Data Theft ORA1692116100725
Incident Response Plan Activated: ['Oracle Security Alert (Urgent Patching Advisory)']
Third Party Assistance: Crowdstrike (Detection And Analysis), Mandiant (Investigation), Google Threat Intelligence Group (Gtig).
Containment Measures: Patching CVE-2025-61882Disabling Exposed EBS Components
Communication Strategy: Oracle Customer AdvisoryPublic Disclosure of PoC Risks
Enhanced Monitoring: Recommended for Oracle EBS Environments
Incident : Data Breach ORA4202442101025
Incident Response Plan Activated: Yes (Google and Oracle)
Third Party Assistance: Google Security Researchers.
Remediation Measures: Oracle Security Advisory IssuedTechnical Indicators Shared by Google for Detection
Communication Strategy: Public Advisory by OracleBlog Post by GoogleMedia Statements
Enhanced Monitoring: Recommended (Google Provided Indicators for Detection)
Incident : Data Theft ORA4092340101025
Third Party Assistance: Aha’S Preferred Cybersecurity Provider Program, Microsoft (Via Rural Health Resiliency Program).
Containment Measures: Immediate Software Patch Installation (Oracle’s E-Business Suite)Long-Term Cyber Incident Response Planning
Remediation Measures: Cybersecurity AssessmentsCloud Capability EvaluationsCurated Cyber and AI TrainingFoundational Cyber Certifications for IT Staff
Communication Strategy: AHA Advisories with Federal Law Enforcement InputPublic Awareness Campaigns (e.g., Cybersecurity Awareness Month)
Incident : Vulnerability Exploitation ORA0832608101425
Incident Response Plan Activated: Yes (Oracle Released Emergency Security Alerts and Patches)
Third Party Assistance: Google Threat Intelligence, Mandiant, Crowdstrike.
Containment Measures: Emergency Patching (CVE-2025-61884 & CVE-2025-61882)Urgent Advisory for Customers to Apply Updates
Remediation Measures: Patch DeploymentMitigation Guidance for Unpatched Systems
Communication Strategy: Public Security AdvisoriesDirect Customer Notifications
Enhanced Monitoring: Recommended (Oracle Advised Customers to Monitor for Exploitation Attempts)
Incident : Ransomware ORA4332743112125
Remediation Measures: Patch released in October 2025 Security Alert
Incident : Ransomware Attack ORA5233252112125
Third Party Assistance: Security Researchers (The Raven File).
Remediation Measures: Oracle released patch in October 2025
Incident : Data Breach PRIHARDARCOLORA1765173096
Remediation Measures: Oracle released a security patch for the exploited vulnerability
Incident : Data Breach ORAPAR1766015901
Communication Strategy: Data breach notification letters mailed to impacted individuals
Incident : Data Breach, Ransomware PRIORAUNI1766419165
Communication Strategy: Public disclosure on official website, SEC filing, notification letters to affected individuals
Incident : Data Breach ORA1766435444
Communication Strategy: Written notice to affected individuals on Dec. 22, 2025
What is the company's incident response plan?
Incident Response Plan: The company's incident response plan is described as Recommended (investigate Oracle E-Business Suite environments), , , Yes (Oracle released patch and urged immediate installation), Oracle Security Alert (Urgent Patching Advisory), , Yes (Google and Oracle), Yes (Oracle Released Emergency Security Alerts and Patches).
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through Okta Threat Intelligence (analysis by Moussa Diallo), , Mandiant (Google Cloud), GTIG, , Mandiant (Google Cloud), Google Threat Intelligence Group (GTIG), , Mandiant (Google Cloud), , Google Mandiant (investigation and advisory), , CrowdStrike (Detection and Analysis), Mandiant (Investigation), Google Threat Intelligence Group (GTIG), , Google Security Researchers, , AHA’s Preferred Cybersecurity Provider Program, Microsoft (via Rural Health Resiliency Program), , Google Threat Intelligence, Mandiant, CrowdStrike, , Security researchers (THE RAVEN FILE), .
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach ORA392622
Type of Data Compromised: Credit card payment information
Sensitivity of Data: High
Incident : Data Breach ORA344032125
Type of Data Compromised: Sso passwords, Java keystore files, Key files, Jps keys
Number of Records Exposed: 6 million
Sensitivity of Data: High
Data Encryption: Encrypted and hashed passwords
Incident : Data Breach ORA615032225
Type of Data Compromised: Jks files, Encrypted sso passwords, Key files, Jps keys
Number of Records Exposed: 6 million
Sensitivity of Data: High
Data Exfiltration: Yes
Data Encryption: Yes
File Types Exposed: JKS filesSSO passwordsKey filesJPS keys
Incident : Data Breach ORA526032825
Type of Data Compromised: Electronic health records (ehr)
Data Exfiltration: Electronic Health Records (EHR)
Incident : Data Breach ORA455040125
Type of Data Compromised: Sensitive customer data
Sensitivity of Data: High
Incident : Data Breach ORA656040225
Type of Data Compromised: Personal Information
Incident : Data Breach ORA956040325
Type of Data Compromised: Usernames, Email addresses, Hashed passwords, Sso credentials, Ldap credentials, Jks files, Enterprise manager jps keys
Number of Records Exposed: 6 million
Sensitivity of Data: High
File Types Exposed: JKS filesJPS keys
Incident : Data Breach ORA720082025
Type of Data Compromised: Personally identifiable information (pii)
Number of Records Exposed: Unknown
Sensitivity of Data: High
Data Exfiltration: Yes (report accessed)
Personally Identifiable Information: NamesSocial Security Numbers
Incident : phishing ORA805090225
Type of Data Compromised: Credentials (usernames, passwords), Pii (email addresses, phone numbers), Guest data, Payment information, Booking details
Sensitivity of Data: high (financial and personal identifiable information)
Data Exfiltration: likely (credentials sold on dark web)
Personally Identifiable Information: namesemail addressesphone numberspotential payment card data
Incident : Extortion ORA4062140100225
Data Exfiltration: Claimed (unsubstantiated)
Incident : Data Breach ORA1092210100225
Type of Data Compromised: Potentially finance, hr, supply chain data, Client credentials (from january incident)
Sensitivity of Data: High (Enterprise-Critical and Potentially PII)
Data Exfiltration: Claimed by Threat Actor (Unverified)
Personally Identifiable Information: Potential (If HR Data Compromised)
Incident : Data Breach ORA5662156100625
Incident : Data Breach ORA4993249100625
Type of Data Compromised: Personal information (executives), Customer data, Employee hr files
Sensitivity of Data: High (personal and corporate-sensitive data)
Data Exfiltration: Yes (evidenced by extortion emails)
Personally Identifiable Information: Yes (executives' personal data)
Incident : Data Theft ORA1692116100725
Type of Data Compromised: Sensitive corporate documents, Potentially pii
Sensitivity of Data: High (confidential business documents)
Data Exfiltration: Confirmed (by Clop for extortion)
Personally Identifiable Information: Possible (not explicitly confirmed)
Incident : Data Breach ORA4202442101025
Type of Data Compromised: Personally identifiable information (pii) of executives, Customer data, Employee hr files, Corporate sensitive data
Sensitivity of Data: High
Data Exfiltration: Confirmed
Personally Identifiable Information: Yes (Executives and Employees)
Incident : Data Theft ORA4092340101025
Type of Data Compromised: Patient personal data, Potentially sensitive healthcare information
Sensitivity of Data: High (Includes Personally Identifiable Information and Healthcare Records)
Data Encryption: True
Incident : Vulnerability Exploitation ORA0832608101425
Type of Data Compromised: Sensitive resources, Potentially oracle ebs data (as per extortion claims)
Sensitivity of Data: High (Potential Access to Confidential Business Data)
Data Exfiltration: Claimed in Extortion Emails (Unverified)
Incident : Ransomware ORA4332743112125
Type of Data Compromised: Financial records, Personal records, Erp data
Sensitivity of Data: High
Data Exfiltration: Confirmed (threatened release on dark web)
Personally Identifiable Information: Yes
Incident : Ransomware Attack ORA5233252112125
Type of Data Compromised: Corporate internal data, Customer information, Financial records, Personal data
Sensitivity of Data: High
Data Exfiltration: Claimed by Clop (evidenced by dark web leak site listing)
Personally Identifiable Information: Likely (based on extortion threats)
Incident : Data Breach PRIHARDARCOLORA1765173096
Type of Data Compromised: Personal information, Donor data, Student information
Sensitivity of Data: High
Data Exfiltration: Yes
Personally Identifiable Information: Yes
Incident : Data Breach ORAPAR1766015901
Type of Data Compromised: Name, Social security number, Date of birth, Financial account number, Payment card number (without cvv), National id number
Sensitivity of Data: High
Personally Identifiable Information: Yes
Incident : Data Breach, Ransomware PRIORAUNI1766419165
Type of Data Compromised: Personal information, Financial information
Number of Records Exposed: 3,489,274
Sensitivity of Data: High (Social Security numbers, bank account and routing numbers, dates of birth, contact information)
Data Exfiltration: Yes
Personally Identifiable Information: Yes
Incident : Data Breach ORA1766435444
Type of Data Compromised: Names, Dates of birth, Social security numbers, Bank account numbers, Bank routing numbers
Number of Records Exposed: 3,489,274
Sensitivity of Data: High
Data Exfiltration: Yes
Personally Identifiable Information: Yes
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Informed clients, Bolstered Gen 1 server security, , implementation of phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn), adaptive risk assessments for unusual access patterns, , Patch Application, Investigation into Potential Prior Compromise, , Urgent patch installation recommended for all customers, , Oracle Security Advisory Issued, Technical Indicators Shared by Google for Detection, , Cybersecurity Assessments, Cloud Capability Evaluations, Curated Cyber and AI Training, Foundational Cyber Certifications for IT Staff, , Patch Deployment, Mitigation Guidance for Unpatched Systems, , Patch released in October 2025 Security Alert, , Oracle released patch in October 2025, , Oracle released a security patch for the exploited vulnerability.
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by password change recommendation, , monitoring for suspicious domain registrations, blocking known malicious domains, , emergency patch release (cve-2025-61882), advisory for customer mitigation, , patch release (cve-2025-61882), indicators of compromise (iocs) shared with customers, , patching cve-2025-61882, disabling exposed ebs components, , immediate software patch installation (oracle’s e-business suite), long-term cyber incident response planning, , emergency patching (cve-2025-61884 & cve-2025-61882), urgent advisory for customers to apply updates and .
Ransomware Information
Was ransomware involved in any of the incidents ?
Incident : Extortion ORA4062140100225
Ransomware Strain: Clop (potential link)
Data Exfiltration: Claimed (unsubstantiated)
Incident : Data Breach ORA1092210100225
Ransomware Strain: Clop (Claimed Affiliation)
Data Exfiltration: Claimed (Unverified)
Incident : Data Breach ORA4993249100625
Ransom Demanded: Yes (extortion emails sent to executives)
Data Exfiltration: Yes
Incident : Data Theft ORA1692116100725
Ransom Demanded: ['Undisclosed (extortion emails sent to executives)']
Ransomware Strain: Clop
Data Encryption: ['No (data theft-only campaign)']
Data Exfiltration: ['Yes']
Incident : Vulnerability Exploitation ORA0832608101425
Ransom Demanded: Extortion Emails Sent (Amount Unspecified)
Ransomware Strain: Cl0p
Data Exfiltration: Claimed (Unverified)
Incident : Ransomware Attack ORA5233252112125
Ransomware Strain: Clop
Data Exfiltration: Confirmed (threatened public release)
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Data Breach ORA526032825
Regulations Violated: HIPAA,
Incident : Data Breach ORA720082025
Regulatory Notifications: California Office of the Attorney General
Incident : Data Breach ORA1092210100225
Regulatory Notifications: CISA Warning (January Incident, Potentially Linked)
Incident : Data Theft ORA1692116100725
Regulatory Notifications: Oracle Customer Advisory (non-regulatory)
Incident : Data Breach ORAPAR1766015901
Regulatory Notifications: Reported to the Attorney General of the Commonwealth of Massachusetts
Incident : Data Breach, Ransomware PRIORAUNI1766419165
Regulations Violated: Potential violations of data protection laws (e.g., FERPA, GDPR if applicable),
Regulatory Notifications: Filed with Maine's Attorney General, SEC filing
Incident : Data Breach ORA1766435444
Regulatory Notifications: California Attorney General's officeMaine Attorney General's office
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : phishing ORA805090225
Lessons Learned: Malvertising is an effective initial access vector for targeted phishing campaigns., MFA bypass techniques (e.g., real-time OTP capture) undermine traditional authentication methods., Typosquatted domains and convincing phishing pages can evade user scrutiny., Russian-speaking threat actors continue to leverage proxy infrastructure for anonymity., Hospitality industry is a high-value target due to sensitive guest data and payment systems.
Incident : Data Breach ORA5662156100625
Lessons Learned: Zero-day vulnerabilities in widely used enterprise software like Oracle E-Business Suite can lead to rapid, high-impact exploitation by multiple threat actors. Organizations must prioritize patch management and assume breach scenarios even after patching, given the likelihood of prior compromise during mass exploitation campaigns.
Incident : Data Theft ORA1692116100725
Lessons Learned: Zero-day vulnerabilities in enterprise software like Oracle EBS are high-value targets for ransomware groups., Public PoC disclosures accelerate exploitation by multiple threat actors., Proactive patching and exposure management are critical for mitigating RCE risks.
Incident : Data Breach ORA4202442101025
Lessons Learned: Zero-day vulnerabilities in widely used enterprise software can lead to large-scale data breaches. Proactive patch management and monitoring for unusual network activity are critical. Vendors must ensure transparent communication during ongoing incidents to avoid misinformation.
Incident : Data Theft ORA4092340101025
Lessons Learned: The incident underscores the critical need for timely patch management, robust cybersecurity defenses, and collaboration between healthcare providers, government agencies, and private-sector partners. Under-resourced organizations, such as rural hospitals, require additional support to mitigate cyber risks effectively. A proactive, whole-of-government approach—including offensive cyber capabilities and threat intelligence sharing—is essential to disrupt adversaries before attacks occur.
Incident : Vulnerability Exploitation ORA0832608101425
Lessons Learned: Critical Importance of Timely Patching for Public-Facing Applications, Risks of Zero-Day Exploitation in Enterprise Software, Need for Enhanced Monitoring of Oracle EBS Instances, Potential for Mass Extortion Campaigns Leveraging Stolen Credentials
What recommendations were made to prevent future incidents ?
Incident : Data Breach ORA392622
Recommendations: Change Passwords, Enhance Security MeasuresChange Passwords, Enhance Security Measures
Incident : phishing ORA805090225
Recommendations: Adopt phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn)., Implement adaptive risk assessments to detect anomalous access patterns., Monitor for suspicious domain registrations (e.g., typosquatting)., Educate employees and customers about malvertising and phishing risks., Deploy behavioral analytics to detect beaconing and tracking scripts., Restrict access to property management systems with zero-trust principles., Collaborate with threat intelligence providers (e.g., Okta) for IOCs.Adopt phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn)., Implement adaptive risk assessments to detect anomalous access patterns., Monitor for suspicious domain registrations (e.g., typosquatting)., Educate employees and customers about malvertising and phishing risks., Deploy behavioral analytics to detect beaconing and tracking scripts., Restrict access to property management systems with zero-trust principles., Collaborate with threat intelligence providers (e.g., Okta) for IOCs.Adopt phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn)., Implement adaptive risk assessments to detect anomalous access patterns., Monitor for suspicious domain registrations (e.g., typosquatting)., Educate employees and customers about malvertising and phishing risks., Deploy behavioral analytics to detect beaconing and tracking scripts., Restrict access to property management systems with zero-trust principles., Collaborate with threat intelligence providers (e.g., Okta) for IOCs.Adopt phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn)., Implement adaptive risk assessments to detect anomalous access patterns., Monitor for suspicious domain registrations (e.g., typosquatting)., Educate employees and customers about malvertising and phishing risks., Deploy behavioral analytics to detect beaconing and tracking scripts., Restrict access to property management systems with zero-trust principles., Collaborate with threat intelligence providers (e.g., Okta) for IOCs.Adopt phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn)., Implement adaptive risk assessments to detect anomalous access patterns., Monitor for suspicious domain registrations (e.g., typosquatting)., Educate employees and customers about malvertising and phishing risks., Deploy behavioral analytics to detect beaconing and tracking scripts., Restrict access to property management systems with zero-trust principles., Collaborate with threat intelligence providers (e.g., Okta) for IOCs.Adopt phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn)., Implement adaptive risk assessments to detect anomalous access patterns., Monitor for suspicious domain registrations (e.g., typosquatting)., Educate employees and customers about malvertising and phishing risks., Deploy behavioral analytics to detect beaconing and tracking scripts., Restrict access to property management systems with zero-trust principles., Collaborate with threat intelligence providers (e.g., Okta) for IOCs.Adopt phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn)., Implement adaptive risk assessments to detect anomalous access patterns., Monitor for suspicious domain registrations (e.g., typosquatting)., Educate employees and customers about malvertising and phishing risks., Deploy behavioral analytics to detect beaconing and tracking scripts., Restrict access to property management systems with zero-trust principles., Collaborate with threat intelligence providers (e.g., Okta) for IOCs.
Incident : Extortion ORA4062140100225
Recommendations: Investigate Oracle E-Business Suite environments for unusual access or compromise, Monitor for high-volume extortion email campaigns from compromised accounts, Assess potential links to FIN11/Clop ransomware activityInvestigate Oracle E-Business Suite environments for unusual access or compromise, Monitor for high-volume extortion email campaigns from compromised accounts, Assess potential links to FIN11/Clop ransomware activityInvestigate Oracle E-Business Suite environments for unusual access or compromise, Monitor for high-volume extortion email campaigns from compromised accounts, Assess potential links to FIN11/Clop ransomware activity
Incident : Data Breach ORA5662156100625
Recommendations: Immediately apply Oracle's emergency patch for CVE-2025-61882., Conduct forensic investigations to detect signs of prior exploitation., Monitor for IoCs, including the listed IP addresses (200.107.207[.]26, 185.181.60[.]11) and exploit artifacts., Enhance logging and network segmentation for Oracle EBS environments., Review Mandiant's advisory for additional mitigation strategies.Immediately apply Oracle's emergency patch for CVE-2025-61882., Conduct forensic investigations to detect signs of prior exploitation., Monitor for IoCs, including the listed IP addresses (200.107.207[.]26, 185.181.60[.]11) and exploit artifacts., Enhance logging and network segmentation for Oracle EBS environments., Review Mandiant's advisory for additional mitigation strategies.Immediately apply Oracle's emergency patch for CVE-2025-61882., Conduct forensic investigations to detect signs of prior exploitation., Monitor for IoCs, including the listed IP addresses (200.107.207[.]26, 185.181.60[.]11) and exploit artifacts., Enhance logging and network segmentation for Oracle EBS environments., Review Mandiant's advisory for additional mitigation strategies.Immediately apply Oracle's emergency patch for CVE-2025-61882., Conduct forensic investigations to detect signs of prior exploitation., Monitor for IoCs, including the listed IP addresses (200.107.207[.]26, 185.181.60[.]11) and exploit artifacts., Enhance logging and network segmentation for Oracle EBS environments., Review Mandiant's advisory for additional mitigation strategies.Immediately apply Oracle's emergency patch for CVE-2025-61882., Conduct forensic investigations to detect signs of prior exploitation., Monitor for IoCs, including the listed IP addresses (200.107.207[.]26, 185.181.60[.]11) and exploit artifacts., Enhance logging and network segmentation for Oracle EBS environments., Review Mandiant's advisory for additional mitigation strategies.
Incident : Data Breach ORA4993249100625
Recommendations: Install Oracle's patch for CVE-2025-61882 immediately, Monitor systems for Indicators of Compromise (IoCs) provided by Oracle, Enhance security for executive personal data, Review third-party vulnerability disclosures for proactive patchingInstall Oracle's patch for CVE-2025-61882 immediately, Monitor systems for Indicators of Compromise (IoCs) provided by Oracle, Enhance security for executive personal data, Review third-party vulnerability disclosures for proactive patchingInstall Oracle's patch for CVE-2025-61882 immediately, Monitor systems for Indicators of Compromise (IoCs) provided by Oracle, Enhance security for executive personal data, Review third-party vulnerability disclosures for proactive patchingInstall Oracle's patch for CVE-2025-61882 immediately, Monitor systems for Indicators of Compromise (IoCs) provided by Oracle, Enhance security for executive personal data, Review third-party vulnerability disclosures for proactive patching
Incident : Data Theft ORA1692116100725
Recommendations: Immediately patch CVE-2025-61882 in Oracle E-Business Suite environments., Restrict internet exposure of EBS applications and enforce authentication controls., Monitor for signs of data exfiltration, especially via BI Publisher components., Prepare for extortion attempts if using Oracle EBS, given Clop’s history of targeting such vulnerabilities., Engage threat intelligence services (e.g., CrowdStrike, Mandiant) for proactive detection.Immediately patch CVE-2025-61882 in Oracle E-Business Suite environments., Restrict internet exposure of EBS applications and enforce authentication controls., Monitor for signs of data exfiltration, especially via BI Publisher components., Prepare for extortion attempts if using Oracle EBS, given Clop’s history of targeting such vulnerabilities., Engage threat intelligence services (e.g., CrowdStrike, Mandiant) for proactive detection.Immediately patch CVE-2025-61882 in Oracle E-Business Suite environments., Restrict internet exposure of EBS applications and enforce authentication controls., Monitor for signs of data exfiltration, especially via BI Publisher components., Prepare for extortion attempts if using Oracle EBS, given Clop’s history of targeting such vulnerabilities., Engage threat intelligence services (e.g., CrowdStrike, Mandiant) for proactive detection.Immediately patch CVE-2025-61882 in Oracle E-Business Suite environments., Restrict internet exposure of EBS applications and enforce authentication controls., Monitor for signs of data exfiltration, especially via BI Publisher components., Prepare for extortion attempts if using Oracle EBS, given Clop’s history of targeting such vulnerabilities., Engage threat intelligence services (e.g., CrowdStrike, Mandiant) for proactive detection.Immediately patch CVE-2025-61882 in Oracle E-Business Suite environments., Restrict internet exposure of EBS applications and enforce authentication controls., Monitor for signs of data exfiltration, especially via BI Publisher components., Prepare for extortion attempts if using Oracle EBS, given Clop’s history of targeting such vulnerabilities., Engage threat intelligence services (e.g., CrowdStrike, Mandiant) for proactive detection.
Incident : Data Breach ORA4202442101025
Recommendations: Immediately patch Oracle E-Business Suite to the latest version., Monitor networks for indicators of compromise (IoCs) provided by Google., Implement multi-factor authentication (MFA) for all critical systems., Conduct regular security audits for enterprise software., Educate employees about phishing and extortion email tactics.Immediately patch Oracle E-Business Suite to the latest version., Monitor networks for indicators of compromise (IoCs) provided by Google., Implement multi-factor authentication (MFA) for all critical systems., Conduct regular security audits for enterprise software., Educate employees about phishing and extortion email tactics.Immediately patch Oracle E-Business Suite to the latest version., Monitor networks for indicators of compromise (IoCs) provided by Google., Implement multi-factor authentication (MFA) for all critical systems., Conduct regular security audits for enterprise software., Educate employees about phishing and extortion email tactics.Immediately patch Oracle E-Business Suite to the latest version., Monitor networks for indicators of compromise (IoCs) provided by Google., Implement multi-factor authentication (MFA) for all critical systems., Conduct regular security audits for enterprise software., Educate employees about phishing and extortion email tactics.Immediately patch Oracle E-Business Suite to the latest version., Monitor networks for indicators of compromise (IoCs) provided by Google., Implement multi-factor authentication (MFA) for all critical systems., Conduct regular security audits for enterprise software., Educate employees about phishing and extortion email tactics.
Incident : Data Theft ORA4092340101025
Recommendations: Install Immediate Patches for Oracle’s E-Business Suite and Other Critical Systems, Develop and Maintain a Comprehensive Cyber Incident Response Plan, Plan for Clinical Continuity During Cyber Disruptions, Leverage AHA’s Cybersecurity Resources, Including Preferred Provider Programs and Advisory Services, Participate in Free or Discounted Cybersecurity Assessments (e.g., Microsoft’s Rural Health Resiliency Program), Invest in Training and Certifications for IT Staff, Particularly in Rural Healthcare Settings, Strengthen Public-Private Partnerships to Share Threat Intelligence and Best Practices, Advocate for Federal and Allied Nation Interventions to Deter Cyber AdversariesInstall Immediate Patches for Oracle’s E-Business Suite and Other Critical Systems, Develop and Maintain a Comprehensive Cyber Incident Response Plan, Plan for Clinical Continuity During Cyber Disruptions, Leverage AHA’s Cybersecurity Resources, Including Preferred Provider Programs and Advisory Services, Participate in Free or Discounted Cybersecurity Assessments (e.g., Microsoft’s Rural Health Resiliency Program), Invest in Training and Certifications for IT Staff, Particularly in Rural Healthcare Settings, Strengthen Public-Private Partnerships to Share Threat Intelligence and Best Practices, Advocate for Federal and Allied Nation Interventions to Deter Cyber AdversariesInstall Immediate Patches for Oracle’s E-Business Suite and Other Critical Systems, Develop and Maintain a Comprehensive Cyber Incident Response Plan, Plan for Clinical Continuity During Cyber Disruptions, Leverage AHA’s Cybersecurity Resources, Including Preferred Provider Programs and Advisory Services, Participate in Free or Discounted Cybersecurity Assessments (e.g., Microsoft’s Rural Health Resiliency Program), Invest in Training and Certifications for IT Staff, Particularly in Rural Healthcare Settings, Strengthen Public-Private Partnerships to Share Threat Intelligence and Best Practices, Advocate for Federal and Allied Nation Interventions to Deter Cyber AdversariesInstall Immediate Patches for Oracle’s E-Business Suite and Other Critical Systems, Develop and Maintain a Comprehensive Cyber Incident Response Plan, Plan for Clinical Continuity During Cyber Disruptions, Leverage AHA’s Cybersecurity Resources, Including Preferred Provider Programs and Advisory Services, Participate in Free or Discounted Cybersecurity Assessments (e.g., Microsoft’s Rural Health Resiliency Program), Invest in Training and Certifications for IT Staff, Particularly in Rural Healthcare Settings, Strengthen Public-Private Partnerships to Share Threat Intelligence and Best Practices, Advocate for Federal and Allied Nation Interventions to Deter Cyber AdversariesInstall Immediate Patches for Oracle’s E-Business Suite and Other Critical Systems, Develop and Maintain a Comprehensive Cyber Incident Response Plan, Plan for Clinical Continuity During Cyber Disruptions, Leverage AHA’s Cybersecurity Resources, Including Preferred Provider Programs and Advisory Services, Participate in Free or Discounted Cybersecurity Assessments (e.g., Microsoft’s Rural Health Resiliency Program), Invest in Training and Certifications for IT Staff, Particularly in Rural Healthcare Settings, Strengthen Public-Private Partnerships to Share Threat Intelligence and Best Practices, Advocate for Federal and Allied Nation Interventions to Deter Cyber AdversariesInstall Immediate Patches for Oracle’s E-Business Suite and Other Critical Systems, Develop and Maintain a Comprehensive Cyber Incident Response Plan, Plan for Clinical Continuity During Cyber Disruptions, Leverage AHA’s Cybersecurity Resources, Including Preferred Provider Programs and Advisory Services, Participate in Free or Discounted Cybersecurity Assessments (e.g., Microsoft’s Rural Health Resiliency Program), Invest in Training and Certifications for IT Staff, Particularly in Rural Healthcare Settings, Strengthen Public-Private Partnerships to Share Threat Intelligence and Best Practices, Advocate for Federal and Allied Nation Interventions to Deter Cyber AdversariesInstall Immediate Patches for Oracle’s E-Business Suite and Other Critical Systems, Develop and Maintain a Comprehensive Cyber Incident Response Plan, Plan for Clinical Continuity During Cyber Disruptions, Leverage AHA’s Cybersecurity Resources, Including Preferred Provider Programs and Advisory Services, Participate in Free or Discounted Cybersecurity Assessments (e.g., Microsoft’s Rural Health Resiliency Program), Invest in Training and Certifications for IT Staff, Particularly in Rural Healthcare Settings, Strengthen Public-Private Partnerships to Share Threat Intelligence and Best Practices, Advocate for Federal and Allied Nation Interventions to Deter Cyber AdversariesInstall Immediate Patches for Oracle’s E-Business Suite and Other Critical Systems, Develop and Maintain a Comprehensive Cyber Incident Response Plan, Plan for Clinical Continuity During Cyber Disruptions, Leverage AHA’s Cybersecurity Resources, Including Preferred Provider Programs and Advisory Services, Participate in Free or Discounted Cybersecurity Assessments (e.g., Microsoft’s Rural Health Resiliency Program), Invest in Training and Certifications for IT Staff, Particularly in Rural Healthcare Settings, Strengthen Public-Private Partnerships to Share Threat Intelligence and Best Practices, Advocate for Federal and Allied Nation Interventions to Deter Cyber Adversaries
Incident : Vulnerability Exploitation ORA0832608101425
Recommendations: Apply Oracle Security Alerts and Critical Patch Updates Immediately, Monitor for Signs of Exploitation (e.g., Unusual Database Activity, Extortion Emails), Implement Multi-Factor Authentication (MFA) for Oracle EBS, Review and Secure Default Password Reset Mechanisms, Segment Networks to Limit Lateral Movement, Engage Third-Party Threat Intelligence for Indicators of Compromise (IOCs)Apply Oracle Security Alerts and Critical Patch Updates Immediately, Monitor for Signs of Exploitation (e.g., Unusual Database Activity, Extortion Emails), Implement Multi-Factor Authentication (MFA) for Oracle EBS, Review and Secure Default Password Reset Mechanisms, Segment Networks to Limit Lateral Movement, Engage Third-Party Threat Intelligence for Indicators of Compromise (IOCs)Apply Oracle Security Alerts and Critical Patch Updates Immediately, Monitor for Signs of Exploitation (e.g., Unusual Database Activity, Extortion Emails), Implement Multi-Factor Authentication (MFA) for Oracle EBS, Review and Secure Default Password Reset Mechanisms, Segment Networks to Limit Lateral Movement, Engage Third-Party Threat Intelligence for Indicators of Compromise (IOCs)Apply Oracle Security Alerts and Critical Patch Updates Immediately, Monitor for Signs of Exploitation (e.g., Unusual Database Activity, Extortion Emails), Implement Multi-Factor Authentication (MFA) for Oracle EBS, Review and Secure Default Password Reset Mechanisms, Segment Networks to Limit Lateral Movement, Engage Third-Party Threat Intelligence for Indicators of Compromise (IOCs)Apply Oracle Security Alerts and Critical Patch Updates Immediately, Monitor for Signs of Exploitation (e.g., Unusual Database Activity, Extortion Emails), Implement Multi-Factor Authentication (MFA) for Oracle EBS, Review and Secure Default Password Reset Mechanisms, Segment Networks to Limit Lateral Movement, Engage Third-Party Threat Intelligence for Indicators of Compromise (IOCs)Apply Oracle Security Alerts and Critical Patch Updates Immediately, Monitor for Signs of Exploitation (e.g., Unusual Database Activity, Extortion Emails), Implement Multi-Factor Authentication (MFA) for Oracle EBS, Review and Secure Default Password Reset Mechanisms, Segment Networks to Limit Lateral Movement, Engage Third-Party Threat Intelligence for Indicators of Compromise (IOCs)
Incident : Ransomware Attack ORA5233252112125
Recommendations: Immediate patching of CVE-2025-61882 for Oracle EBS versions 12.2.3–12.2.14, Monitor for indicators of compromise (IOCs) linked to Clop’s infrastructure (e.g., 96 IPs, support@pubstorm[.]com), Enhance authentication mechanisms for OA_HTML endpoints, Segment networks to limit lateral movement, Implement behavioral analysis for XSLT injection attemptsImmediate patching of CVE-2025-61882 for Oracle EBS versions 12.2.3–12.2.14, Monitor for indicators of compromise (IOCs) linked to Clop’s infrastructure (e.g., 96 IPs, support@pubstorm[.]com), Enhance authentication mechanisms for OA_HTML endpoints, Segment networks to limit lateral movement, Implement behavioral analysis for XSLT injection attemptsImmediate patching of CVE-2025-61882 for Oracle EBS versions 12.2.3–12.2.14, Monitor for indicators of compromise (IOCs) linked to Clop’s infrastructure (e.g., 96 IPs, support@pubstorm[.]com), Enhance authentication mechanisms for OA_HTML endpoints, Segment networks to limit lateral movement, Implement behavioral analysis for XSLT injection attemptsImmediate patching of CVE-2025-61882 for Oracle EBS versions 12.2.3–12.2.14, Monitor for indicators of compromise (IOCs) linked to Clop’s infrastructure (e.g., 96 IPs, support@pubstorm[.]com), Enhance authentication mechanisms for OA_HTML endpoints, Segment networks to limit lateral movement, Implement behavioral analysis for XSLT injection attemptsImmediate patching of CVE-2025-61882 for Oracle EBS versions 12.2.3–12.2.14, Monitor for indicators of compromise (IOCs) linked to Clop’s infrastructure (e.g., 96 IPs, support@pubstorm[.]com), Enhance authentication mechanisms for OA_HTML endpoints, Segment networks to limit lateral movement, Implement behavioral analysis for XSLT injection attempts
Incident : Data Breach ORA1766435444
Recommendations: Sign up for free IDX identity theft protection services, Monitor financial statements for suspicious activity, Request a fraud alert or credit report from major credit bureaus, Seek legal help to understand rights and pursue compensationSign up for free IDX identity theft protection services, Monitor financial statements for suspicious activity, Request a fraud alert or credit report from major credit bureaus, Seek legal help to understand rights and pursue compensationSign up for free IDX identity theft protection services, Monitor financial statements for suspicious activity, Request a fraud alert or credit report from major credit bureaus, Seek legal help to understand rights and pursue compensationSign up for free IDX identity theft protection services, Monitor financial statements for suspicious activity, Request a fraud alert or credit report from major credit bureaus, Seek legal help to understand rights and pursue compensation
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are Malvertising is an effective initial access vector for targeted phishing campaigns.,MFA bypass techniques (e.g., real-time OTP capture) undermine traditional authentication methods.,Typosquatted domains and convincing phishing pages can evade user scrutiny.,Russian-speaking threat actors continue to leverage proxy infrastructure for anonymity.,Hospitality industry is a high-value target due to sensitive guest data and payment systems.Zero-day vulnerabilities in widely used enterprise software like Oracle E-Business Suite can lead to rapid, high-impact exploitation by multiple threat actors. Organizations must prioritize patch management and assume breach scenarios even after patching, given the likelihood of prior compromise during mass exploitation campaigns.Zero-day vulnerabilities in enterprise software like Oracle EBS are high-value targets for ransomware groups.,Public PoC disclosures accelerate exploitation by multiple threat actors.,Proactive patching and exposure management are critical for mitigating RCE risks.Zero-day vulnerabilities in widely used enterprise software can lead to large-scale data breaches. Proactive patch management and monitoring for unusual network activity are critical. Vendors must ensure transparent communication during ongoing incidents to avoid misinformation.The incident underscores the critical need for timely patch management, robust cybersecurity defenses, and collaboration between healthcare providers, government agencies, and private-sector partners. Under-resourced organizations, such as rural hospitals, require additional support to mitigate cyber risks effectively. A proactive, whole-of-government approach—including offensive cyber capabilities and threat intelligence sharing—is essential to disrupt adversaries before attacks occur.Critical Importance of Timely Patching for Public-Facing Applications,Risks of Zero-Day Exploitation in Enterprise Software,Need for Enhanced Monitoring of Oracle EBS Instances,Potential for Mass Extortion Campaigns Leveraging Stolen Credentials.
What recommendations has the company implemented to improve cybersecurity ?
Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Monitor networks for indicators of compromise (IoCs) provided by Google., Review and Secure Default Password Reset Mechanisms, Investigate Oracle E-Business Suite environments for unusual access or compromise, Implement Multi-Factor Authentication (MFA) for Oracle EBS, Educate employees about phishing and extortion email tactics., Assess potential links to FIN11/Clop ransomware activity, Conduct regular security audits for enterprise software., Enhance logging and network segmentation for Oracle EBS environments., Review Mandiant's advisory for additional mitigation strategies., Monitor for Signs of Exploitation (e.g., Unusual Database Activity, Extortion Emails), Monitor for IoCs, including the listed IP addresses (200.107.207[.]26, 185.181.60[.]11) and exploit artifacts., Immediately apply Oracle's emergency patch for CVE-2025-61882., Segment Networks to Limit Lateral Movement, Immediately patch Oracle E-Business Suite to the latest version., Implement multi-factor authentication (MFA) for all critical systems., Engage Third-Party Threat Intelligence for Indicators of Compromise (IOCs), Monitor for high-volume extortion email campaigns from compromised accounts, Conduct forensic investigations to detect signs of prior exploitation. and Apply Oracle Security Alerts and Critical Patch Updates Immediately.
References
Where can I find more information about each incident ?
Incident : Data Breach ORA656040225
Source: Cyber Incident Description
Incident : Data Breach ORA720082025
Source: California Office of the Attorney General
Incident : phishing ORA805090225
Source: Okta Threat Intelligence (contributor: Moussa Diallo)
Incident : Extortion ORA4062140100225
Source: BleepingComputer
Incident : Extortion ORA4062140100225
Source: Mandiant (Google Cloud) & GTIG Analysis
Incident : Extortion ORA4062140100225
Source: U.S. State Department Rewards for Justice Program (Clop)
Incident : Data Breach ORA1092210100225
Source: CISA Advisory (January 2023 Oracle Incident)
Incident : Data Breach ORA1092210100225
Source: Emsisoft (MOVEit Impact Report)
Incident : Data Breach ORA5662156100625
Source: Mandiant (Google Cloud) Alert on Cl0p Campaign
Date Accessed: 2025-08
Incident : Data Breach ORA5662156100625
Source: LinkedIn Post by Charles Carmakal (Mandiant CTO)
Date Accessed: 2025-08
Incident : Data Breach ORA4993249100625
Source: Oracle Security Advisory (Rob Duhart, CSO)
Date Accessed: 2025-10-02
Incident : Data Breach ORA4993249100625
Source: Google Mandiant (Charles Carmakal, CTO) - LinkedIn Post
Date Accessed: 2025-10-02
Incident : Data Theft ORA1692116100725
Source: Oracle Security Alert (CVE-2025-61882)
Date Accessed: 2025-10-05
Incident : Data Theft ORA1692116100725
Source: watchTowr Labs (PoC Analysis)
Date Accessed: 2025-05-01
Incident : Data Theft ORA1692116100725
Source: U.S. State Department Reward Program
Incident : Data Breach ORA4202442101025
Source: TechCrunch
URL: https://techcrunch.com/2023/10/05/google-clop-oracle-zero-day-hack/
Date Accessed: 2023-10-05
Incident : Data Breach ORA4202442101025
Source: Google Blog Post
URL: https://blog.google/threat-analysis-group/clop-oracle-zero-day/
Date Accessed: 2023-10-05
Incident : Data Breach ORA4202442101025
Source: Oracle Security Advisory
URL: https://www.oracle.com/security-alerts/
Date Accessed: 2023-10-05
Incident : Data Theft ORA4092340101025
Source: American Hospital Association (AHA) Cybersecurity and Risk Webpage
Incident : Data Theft ORA4092340101025
Source: FBI Warning on Oracle E-Business Suite Vulnerability
Incident : Data Theft ORA4092340101025
Source: AHA and Microsoft Rural Health Resiliency Program
Incident : Vulnerability Exploitation ORA0832608101425
Source: SecurityAffairs
URL: https://securityaffairs.co/wordpress/150000/hacking/oracle-ebs-flaw-cve-2025-61884.html
Date Accessed: 2025-10-14
Incident : Vulnerability Exploitation ORA0832608101425
Source: Oracle Security Alert Advisory
Date Accessed: 2025-10-14
Incident : Vulnerability Exploitation ORA0832608101425
Source: Google Threat Intelligence & Mandiant Analysis
Date Accessed: 2025-10-03
Incident : Vulnerability Exploitation ORA0832608101425
Source: CrowdStrike Report on CVE-2025-61882 Exploitation
Date Accessed: 2025-10-03
Incident : Ransomware ORA4332743112125
Source: THE RAVEN FILE Security Researchers
Incident : Ransomware ORA4332743112125
Source: Clop Ransomware Dark Web Leak Site
Incident : Ransomware ORA4332743112125
Source: Oracle Security Alert (October 2025)
Incident : Ransomware Attack ORA5233252112125
Source: THE RAVEN FILE (Security Research)
Incident : Ransomware Attack ORA5233252112125
Source: Clop Dark Web Leak Site
Incident : Ransomware Attack ORA5233252112125
Source: Oracle Security Advisory (CVE-2025-61882)
Incident : Data Breach PRIHARDARCOLORA1765173096
Source: News Article
Incident : Data Breach ORAPAR1766015901
Source: Attorney General of the Commonwealth of Massachusetts
Incident : Data Breach, Ransomware PRIORAUNI1766419165
Source: BleepingComputer
Incident : Data Breach, Ransomware PRIORAUNI1766419165
Source: University of Phoenix Official Website
Incident : Data Breach, Ransomware PRIORAUNI1766419165
Source: SEC Filing (8-K)
Incident : Data Breach ORA1766435444
Source: Shamis & Gentile P.A.
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Cyber Incident Description, and Source: California Office of the Attorney General, and Source: Okta Threat Intelligence (contributor: Moussa Diallo), and Source: BleepingComputer, and Source: Mandiant (Google Cloud) & GTIG Analysis, and Source: U.S. State Department Rewards for Justice Program (Clop)Url: https://www.state.gov/rewards-for-justice-program/, and Source: Recorded Future NewsDate Accessed: 2023-10-04, and Source: Mandiant/GTIG WarningDate Accessed: 2023-10-04, and Source: CISA Advisory (January 2023 Oracle Incident)Url: https://www.cisa.gov/, and Source: Emsisoft (MOVEit Impact Report), and Source: Oracle Security AdvisoryDate Accessed: 2025-08, and Source: Mandiant (Google Cloud) Alert on Cl0p CampaignDate Accessed: 2025-08, and Source: LinkedIn Post by Charles Carmakal (Mandiant CTO)Date Accessed: 2025-08, and Source: Oracle Security Advisory (Rob Duhart, CSO)Date Accessed: 2025-10-02, and Source: Google Mandiant (Charles Carmakal, CTO) - LinkedIn PostDate Accessed: 2025-10-02, and Source: CrowdStrike BlogDate Accessed: 2025-10-07, and Source: BleepingComputer ArticleDate Accessed: 2025-10-06, and Source: Oracle Security Alert (CVE-2025-61882)Date Accessed: 2025-10-05, and Source: watchTowr Labs (PoC Analysis)Date Accessed: 2025-05-01, and Source: U.S. State Department Reward Program, and Source: TechCrunchUrl: https://techcrunch.com/2023/10/05/google-clop-oracle-zero-day-hack/Date Accessed: 2023-10-05, and Source: Google Blog PostUrl: https://blog.google/threat-analysis-group/clop-oracle-zero-day/Date Accessed: 2023-10-05, and Source: Oracle Security AdvisoryUrl: https://www.oracle.com/security-alerts/Date Accessed: 2023-10-05, and Source: American Hospital Association (AHA) Cybersecurity and Risk WebpageUrl: https://www.aha.org/cybersecurity, and Source: FBI Warning on Oracle E-Business Suite Vulnerability, and Source: AHA and Microsoft Rural Health Resiliency Program, and Source: SecurityAffairsUrl: https://securityaffairs.co/wordpress/150000/hacking/oracle-ebs-flaw-cve-2025-61884.htmlDate Accessed: 2025-10-14, and Source: Oracle Security Alert AdvisoryDate Accessed: 2025-10-14, and Source: Google Threat Intelligence & Mandiant AnalysisDate Accessed: 2025-10-03, and Source: CrowdStrike Report on CVE-2025-61882 ExploitationDate Accessed: 2025-10-03, and Source: THE RAVEN FILE Security Researchers, and Source: Clop Ransomware Dark Web Leak Site, and Source: Oracle Security Alert (October 2025), and Source: THE RAVEN FILE (Security Research), and Source: Clop Dark Web Leak Site, and Source: Oracle Security Advisory (CVE-2025-61882), and Source: News Article, and Source: Attorney General of the Commonwealth of Massachusetts, and Source: BleepingComputer, and Source: University of Phoenix Official Website, and Source: SEC Filing (8-K), and Source: Shamis & Gentile P.A..
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Data Breach ORA344032125
Investigation Status: Ongoing
Incident : phishing ORA805090225
Investigation Status: ongoing (active campaign)
Incident : Extortion ORA4062140100225
Investigation Status: Ongoing (early stages, claims unsubstantiated)
Incident : Data Breach ORA1092210100225
Investigation Status: Ongoing (Early Stages)
Incident : Data Breach ORA5662156100625
Investigation Status: Ongoing (developing story)
Incident : Data Breach ORA4993249100625
Investigation Status: Ongoing (Google Mandiant involved in analysis)
Incident : Data Theft ORA1692116100725
Investigation Status: Ongoing (CrowdStrike, Mandiant, GTIG)
Incident : Data Breach ORA4202442101025
Investigation Status: Ongoing (Active Exploitation Confirmed)
Incident : Data Theft ORA4092340101025
Investigation Status: Ongoing (FBI and AHA Collaborating on Threat Intelligence and Mitigation)
Incident : Vulnerability Exploitation ORA0832608101425
Investigation Status: Ongoing (Google, Mandiant, and CrowdStrike Investigating Extent of Exploitation)
Incident : Ransomware ORA4332743112125
Investigation Status: Ongoing (infrastructure analysis links to prior MOVEit attacks)
Incident : Ransomware Attack ORA5233252112125
Investigation Status: Ongoing (Clop’s claims under verification; Oracle’s internal investigation likely)
Incident : Data Breach PRIHARDARCOLORA1765173096
Investigation Status: Ongoing
Incident : Data Breach ORAPAR1766015901
Investigation Status: Completed
Incident : Data Breach, Ransomware PRIORAUNI1766419165
Investigation Status: Ongoing
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Customer Advisory, Criticized For Lack Of Transparency, Private letters to customers, Outright Denial, Potentially Misleading Statements, Accusations Of Deleting Evidence Online, Customer Advisories About Impersonation Attempts, Industry-Wide Alerts, Public Warning Via Cybersecurity Firms (Mandiant, Gtig), Media Outreach (Recorded Future News), Public Advisory, Linkedin Post By Oracle Cso, Mandiant Technical Alert, Public Security Advisory By Oracle Cso Rob Duhart, Linkedin Post By Google Mandiant Cto Charles Carmakal, Oracle Customer Advisory, Public Disclosure Of Poc Risks, Public Advisory By Oracle, Blog Post By Google, Media Statements, Aha Advisories With Federal Law Enforcement Input, Public Awareness Campaigns (E.G., Cybersecurity Awareness Month), Public Security Advisories, Direct Customer Notifications, Data breach notification letters mailed to impacted individuals, Public disclosure on official website, SEC filing, notification letters to affected individuals, Written notice to affected individuals on Dec. 22 and 2025.
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : Data Breach ORA392622
Customer Advisories: Oracle urged Micros customers to change their passwords and any passwords used by Micros representatives to access their on-premise systems.
Incident : Data Breach ORA455040125
Customer Advisories: Private letters to customers
Incident : phishing ORA805090225
Stakeholder Advisories: Warn Customers About Impersonation Attempts, Share Indicators Of Compromise (Iocs) With Industry Peers.
Customer Advisories: avoid clicking on sponsored search ads for hospitality servicesverify URLs before entering credentialsreport suspicious login pages
Incident : Extortion ORA4062140100225
Customer Advisories: Recommended: Investigate Oracle E-Business Suite for compromise
Incident : Data Breach ORA1092210100225
Stakeholder Advisories: Mandiant/Gtig Warning To Corporate Executives.
Incident : Data Breach ORA5662156100625
Stakeholder Advisories: Oracle and Mandiant have issued public advisories urging immediate action.
Customer Advisories: Customers advised to patch and investigate potential compromise.
Incident : Data Breach ORA4993249100625
Stakeholder Advisories: Oracle Customers Urged To Patch Immediately, Executives Warned About Extortion Emails.
Customer Advisories: Patch installation guidanceIoCs for detecting compromise
Incident : Data Theft ORA1692116100725
Stakeholder Advisories: Oracle Urgent Patching Advisory, Crowdstrike Threat Assessment.
Customer Advisories: Extortion Emails from Clop to Executives
Incident : Data Breach ORA4202442101025
Stakeholder Advisories: Oracle and Google have issued advisories with technical details for detection and mitigation.
Customer Advisories: Organizations using Oracle E-Business Suite advised to apply patches and monitor for suspicious activity.
Incident : Data Theft ORA4092340101025
Stakeholder Advisories: AHA provides timely alerts and advisories to member hospitals and health systems, incorporating input from federal law enforcement and AHA cybersecurity experts (John Riggi and Scott Gee).
Customer Advisories: Patients and the public are advised to stay informed about potential disruptions to healthcare services and to report suspicious activities. Hospitals are encouraged to communicate transparently with patients about cybersecurity measures and any impacts on care delivery.
Incident : Vulnerability Exploitation ORA0832608101425
Stakeholder Advisories: Oracle Customers Urged To Patch Immediately, Executives Warned About Extortion Emails.
Customer Advisories: Apply Emergency Patches for CVE-2025-61884 and CVE-2025-61882Monitor for Suspicious Activity
Incident : Ransomware Attack ORA5233252112125
Customer Advisories: Extortion emails sent to victims via support@pubstorm[.]com
Incident : Data Breach ORAPAR1766015901
Customer Advisories: 24 months of complimentary credit monitoring services provided to affected individuals
Incident : Data Breach, Ransomware PRIORAUNI1766419165
Stakeholder Advisories: Notification letters mailed to affected individuals, public disclosure on website
Customer Advisories: Free identity protection services offered (credit monitoring, identity theft recovery, dark web monitoring, $1 million fraud reimbursement policy)
Incident : Data Breach ORA1766435444
Customer Advisories: Affected individuals notified via written notice on Dec. 22, 2025
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Oracle urged Micros customers to change their passwords and any passwords used by Micros representatives to access their on-premise systems., Private letters to customers, Warn Customers About Impersonation Attempts, Share Indicators Of Compromise (Iocs) With Industry Peers, Avoid Clicking On Sponsored Search Ads For Hospitality Services, Verify Urls Before Entering Credentials, Report Suspicious Login Pages, , Recommended: Investigate Oracle E-Business Suite for compromise, Mandiant/Gtig Warning To Corporate Executives, Oracle and Mandiant have issued public advisories urging immediate action., Customers advised to patch and investigate potential compromise., Oracle Customers Urged To Patch Immediately, Executives Warned About Extortion Emails, Patch Installation Guidance, Iocs For Detecting Compromise, , Oracle Urgent Patching Advisory, Crowdstrike Threat Assessment, Extortion Emails From Clop To Executives, , Oracle and Google have issued advisories with technical details for detection and mitigation., Organizations using Oracle E-Business Suite advised to apply patches and monitor for suspicious activity., AHA provides timely alerts and advisories to member hospitals and health systems, incorporating input from federal law enforcement and AHA cybersecurity experts (John Riggi and Scott Gee)., Patients and the public are advised to stay informed about potential disruptions to healthcare services and to report suspicious activities. Hospitals are encouraged to communicate transparently with patients about cybersecurity measures and any impacts on care delivery., Oracle Customers Urged To Patch Immediately, Executives Warned About Extortion Emails, Apply Emergency Patches For Cve-2025-61884 And Cve-2025-61882, Monitor For Suspicious Activity, , Extortion Emails Sent To Victims Via Support@Pubstorm[.]Com, , 24 months of complimentary credit monitoring services provided to affected individuals, Notification letters mailed to affected individuals, public disclosure on website, Free identity protection services offered (credit monitoring, identity theft recovery, dark web monitoring, $1 million fraud reimbursement policy), Affected individuals notified via written notice on Dec. 22 and 2025.
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : Data Breach ORA615032225
Entry Point: CVE-2021-35587
Incident : phishing ORA805090225
Entry Point: Malvertising (Malicious Search Engine Ads), Typosquatted Domains,
High Value Targets: Cloud-Based Property Management Systems, Guest Messaging Platforms, Payment Processing Systems,
Data Sold on Dark Web: Cloud-Based Property Management Systems, Guest Messaging Platforms, Payment Processing Systems,
Incident : Extortion ORA4062140100225
Entry Point: Compromised Email Accounts
High Value Targets: Executives at multiple companies
Data Sold on Dark Web: Executives at multiple companies
Incident : Data Breach ORA1092210100225
Entry Point: Compromised Email Accounts, Potential Exploitation Of Oracle E-Business Suite Vulnerabilities,
High Value Targets: Corporate Executives, Finance/Hr/Supply Chain Data,
Data Sold on Dark Web: Corporate Executives, Finance/Hr/Supply Chain Data,
Incident : Data Breach ORA5662156100625
Entry Point: Oracle E-Business Suite Concurrent Processing Component (via HTTP)
High Value Targets: Enterprise data within Oracle EBS environments
Data Sold on Dark Web: Enterprise data within Oracle EBS environments
Incident : Data Breach ORA4993249100625
Entry Point: CVE-2025-61882 (Oracle E-Business Suite zero-day)
Reconnaissance Period: Likely conducted prior to August 2025 (exploitation began in August)
High Value Targets: Corporate Executives' Personal Data,
Data Sold on Dark Web: Corporate Executives' Personal Data,
Incident : Data Theft ORA1692116100725
Entry Point: Cve-2025-61882 (Oracle Ebs Bi Publisher),
Reconnaissance Period: ['Potentially since early August 2025 (zero-day exploitation)']
High Value Targets: Sensitive Corporate Documents,
Data Sold on Dark Web: Sensitive Corporate Documents,
Incident : Data Breach ORA4202442101025
Entry Point: Zero-Day Vulnerability in Oracle E-Business Suite (Network-Based, No Authentication Required)
Reconnaissance Period: Since at least 2023-07-10
High Value Targets: Corporate Executives, Hr And Customer Data,
Data Sold on Dark Web: Corporate Executives, Hr And Customer Data,
Incident : Data Theft ORA4092340101025
Entry Point: Exploitation of Unpatched Vulnerability in Oracle’s E-Business Suite
High Value Targets: Patient Data, Healthcare It Systems, Clinical Operations,
Data Sold on Dark Web: Patient Data, Healthcare It Systems, Clinical Operations,
Incident : Vulnerability Exploitation ORA0832608101425
Entry Point: Exploitation Of Oracle Ebs Vulnerabilities (Cve-2025-61882, Cve-2025-61884), Hacked User Emails, Default Password Reset Mechanisms,
Reconnaissance Period: Potentially Began on 2025-07-10 (Prior to July Patches)
High Value Targets: Company Executives (Extortion Emails), Oracle Ebs Databases,
Data Sold on Dark Web: Company Executives (Extortion Emails), Oracle Ebs Databases,
Incident : Ransomware ORA4332743112125
Entry Point: OA_HTML/SyncServlet (Authentication Bypass) & OA_HTML/RF.jsp (XSLT Injection)
Reconnaissance Period: Observed as early as June 2025, active exploitation from August 2025
High Value Targets: Oracle E-Business Suite Erp Data, Financial Records, Personal Records,
Data Sold on Dark Web: Oracle E-Business Suite Erp Data, Financial Records, Personal Records,
Incident : Ransomware Attack ORA5233252112125
Entry Point: Oracle E-Business Suite (Ebs) Syncservlet Endpoint,
Reconnaissance Period: Likely conducted prior to August 2025 (exploitation start date)
High Value Targets: Erp Data (Order Management, Procurement, Logistics), Customer Databases,
Data Sold on Dark Web: Erp Data (Order Management, Procurement, Logistics), Customer Databases,
Incident : Data Breach PRIHARDARCOLORA1765173096
Entry Point: Phishing (duping school employees)
High Value Targets: Prominent individuals associated with institutions
Data Sold on Dark Web: Prominent individuals associated with institutions
Incident : Data Breach, Ransomware PRIORAUNI1766419165
Entry Point: Oracle E-Business Suite (EBS) zero-day vulnerability (CVE-2025-61882)
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Data Breach ORA615032225
Root Causes: Vulnerable software version, compromised subdomain
Incident : phishing ORA805090225
Root Causes: Over-Reliance On Traditional Mfa Methods Vulnerable To Real-Time Phishing., Lack Of Visibility Into Malvertising Campaigns Targeting Brand Impersonation., Insufficient Monitoring For Typosquatted Domains And Beaconing Activity.,
Corrective Actions: Replace Sms/Email-Based Mfa With Phishing-Resistant Alternatives., Proactively Register Defensive Domains To Prevent Typosquatting., Enhance Threat Intelligence Sharing Within The Hospitality Sector., Deploy Solutions To Detect And Block Malicious Ads In Search Results.,
Incident : Data Breach ORA5662156100625
Root Causes: Zero-Day Vulnerability (Cve-2025-61882) In Oracle E-Business Suite., Lack Of Authentication Requirements For Exploitation., High-Volume Email Campaign Leveraging Compromised Accounts (Per Mandiant).,
Corrective Actions: Emergency Patch Release By Oracle., Public Disclosure And Customer Advisories., Collaboration With Mandiant For Threat Intelligence Sharing.,
Incident : Data Breach ORA4993249100625
Root Causes: Zero-Day Vulnerability (Cve-2025-61882) In Oracle E-Business Suite, Insufficient Proactive Patching For Prior Vulnerabilities (July 2025 Patches Bypassed),
Corrective Actions: Patch Deployment, Customer Advisory For Ioc Monitoring,
Incident : Data Theft ORA1692116100725
Root Causes: Unpatched Oracle Ebs Vulnerability (Cve-2025-61882), Internet-Exposed Ebs Applications Without Authentication Safeguards, Delayed Patching Despite Active Exploitation,
Corrective Actions: Apply Oracle’S Security Patch For Cve-2025-61882., Implement Network Segmentation For Ebs Environments., Deploy Behavioral Detection For Rce Attempts (E.G., Crowdstrike Falcon)., Conduct Threat Hunting For Signs Of Clop Or Graceful Spider Activity.,
Incident : Data Breach ORA4202442101025
Root Causes: Unpatched Zero-Day Vulnerability In Oracle E-Business Suite, Inadequate Initial Response By Oracle (Premature Claim Of Patch Effectiveness), Lack Of Network Segmentation Or Access Controls To Limit Exploitation,
Corrective Actions: Oracle Released Emergency Patches And Advisories, Google Shared Detection Indicators For Affected Organizations, Recommended Enhanced Monitoring For Extortion Emails And Unusual Data Access,
Incident : Data Theft ORA4092340101025
Root Causes: Unpatched Critical Vulnerability In Oracle’S E-Business Suite, Insufficient Cybersecurity Resources In Some Healthcare Organizations (E.G., Rural Hospitals), Sophisticated And Evolving Tactics By Cybercriminals And Nation-State Actors,
Corrective Actions: Mandatory Patch Management Protocols For Critical Software, Enhanced Collaboration Between Healthcare Providers, Government Agencies, And Cybersecurity Firms, Expanded Access To Cybersecurity Training And Resources For Under-Resourced Organizations, Development Of Offensive Cyber Capabilities To Disrupt Adversaries Proactively,
Incident : Vulnerability Exploitation ORA0832608101425
Root Causes: Unpatched Vulnerabilities In Oracle E-Business Suite, Lack Of Authentication For Remote Exploitation, Potential Weaknesses In Default Password Reset Mechanisms, Delayed Patch Deployment By Some Customers,
Corrective Actions: Oracle Released Out-Of-Band Patches, Customers Advised To Apply Patches And Monitor Systems, Enhanced Threat Intelligence Sharing (E.G., Poc Disclosure As Ioc),
Incident : Ransomware ORA4332743112125
Root Causes: Zero-Day Exploit (Cve-2025-61882), Delayed Patch Release (Exploited For Months Pre-Patch), Reused Attack Infrastructure From Moveit (Cve-2023-34362),
Corrective Actions: Patch Deployment (October 2025), Infrastructure Monitoring For 96 Linked Ips (41 Subnets Reused From Moveit),
Incident : Ransomware Attack ORA5233252112125
Root Causes: Unpatched Zero-Day Vulnerability (Cve-2025-61882) In Oracle Ebs, Lack Of Pre-Authentication Protections For Syncservlet Endpoint, Reuse Of Attack Infrastructure From Prior Campaigns (E.G., Moveit Cve-2023-34362),
Incident : Data Breach PRIHARDARCOLORA1765173096
Root Causes: Software Vulnerability, Phishing,
Incident : Data Breach, Ransomware PRIORAUNI1766419165
Root Causes: Exploitation of zero-day vulnerability in Oracle E-Business Suite (CVE-2025-61882)
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Okta Threat Intelligence (Analysis By Moussa Diallo), , Real-Time Tracking Of Typosquatted Domains, Beaconing Detection, , Mandiant (Google Cloud), Gtig, , Recommended (for unusual access), Mandiant (Google Cloud), Google Threat Intelligence Group (Gtig), , Mandiant (Google Cloud), , Recommended for customers to detect prior compromise, Google Mandiant (Investigation And Advisory), , Crowdstrike (Detection And Analysis), Mandiant (Investigation), Google Threat Intelligence Group (Gtig), , Recommended For Oracle Ebs Environments, , Google Security Researchers, , Recommended (Google Provided Indicators for Detection), Aha’S Preferred Cybersecurity Provider Program, Microsoft (Via Rural Health Resiliency Program), , Google Threat Intelligence, Mandiant, Crowdstrike, , Recommended (Oracle Advised Customers to Monitor for Exploitation Attempts), Security Researchers (The Raven File), .
What corrective actions has the company taken based on post-incident analysis ?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Replace Sms/Email-Based Mfa With Phishing-Resistant Alternatives., Proactively Register Defensive Domains To Prevent Typosquatting., Enhance Threat Intelligence Sharing Within The Hospitality Sector., Deploy Solutions To Detect And Block Malicious Ads In Search Results., , Emergency Patch Release By Oracle., Public Disclosure And Customer Advisories., Collaboration With Mandiant For Threat Intelligence Sharing., , Patch Deployment, Customer Advisory For Ioc Monitoring, , Apply Oracle’S Security Patch For Cve-2025-61882., Implement Network Segmentation For Ebs Environments., Deploy Behavioral Detection For Rce Attempts (E.G., Crowdstrike Falcon)., Conduct Threat Hunting For Signs Of Clop Or Graceful Spider Activity., , Oracle Released Emergency Patches And Advisories, Google Shared Detection Indicators For Affected Organizations, Recommended Enhanced Monitoring For Extortion Emails And Unusual Data Access, , Mandatory Patch Management Protocols For Critical Software, Enhanced Collaboration Between Healthcare Providers, Government Agencies, And Cybersecurity Firms, Expanded Access To Cybersecurity Training And Resources For Under-Resourced Organizations, Development Of Offensive Cyber Capabilities To Disrupt Adversaries Proactively, , Oracle Released Out-Of-Band Patches, Customers Advised To Apply Patches And Monitor Systems, Enhanced Threat Intelligence Sharing (E.G., Poc Disclosure As Ioc), , Patch Deployment (October 2025), Infrastructure Monitoring For 96 Linked Ips (41 Subnets Reused From Moveit), .
Additional Questions
General Information
What was the amount of the last ransom demanded ?
Last Ransom Demanded: The amount of the last ransom demanded was Yes (extortion emails sent to executives).
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident were an Russian Cybercrime Group, rose87168, 'rose87168', rose87168, Unauthorized Individual, Russian-speaking cybercriminalsunknown APT/group (potential initial access brokers), FIN11 (suspected)Clop Ransomware Gang (potential link), Clop (FIN11)Potentially Impersonating Clop, Cl0p Ransomware GroupScattered LAPSUS$ Hunters, Clop (hacking group linked to ransomware and extortion), Clop Ransomware GangGRACEFUL SPIDER (moderate confidence), Clop Ransomware/Extortion Gang, Sophisticated CybercriminalsNation-State Sponsored Actors, Cl0p Ransomware Group (Graceful Spider)FIN11Potential involvement of Scattered Spider, Slippy Spider (Lapsus$), ShinyHunters, Clop Ransomware Gang (Graceful Spider), Name: ['Clop Ransomware Gang', 'Graceful Spider']Origin: Russian-linkedConfirmed Victims: 1025Ransom Extracted: $500 million (since 2019)Associated Infrastructure: {'ip_addresses': 96, 'reused_ips_from_moveit': 41, 'geographic_distribution': [{'country': 'Germany', 'ip_count': 16}, {'country': 'Brazil', 'ip_count': 13}, {'country': 'Panama', 'ip_count': 12}], 'service_providers': ['Russian-based']}, Unauthorized third party, Clop ransomware gang and CL0P ransomware group.
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2013-07-10.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-12-21.
Impact of the Incidents
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Credit Card Payment Information, , SSO passwords, Java Keystore files, Key files, JPS keys, , JKS files, Encrypted SSO passwords, Key files, JPS keys, , Electronic Health Records (EHR), , Personal Information, usernames, email addresses, hashed passwords, SSO credentials, LDAP credentials, JKS files, Enterprise Manager JPS keys, , Names, Social Security Numbers, , guest personal information, payment data, booking system credentials, operational data, , Potentially Finance, HR, and Supply Chain Data (Oracle E-Business Suite), , Large amounts of data (exact scope undisclosed), Personal information of corporate executives, Customer data, Employee HR files, , Sensitive Documents, Potentially PII or Corporate Data, , Corporate Executive Data, Customer Data, Employee HR Files, Sensitive Corporate Data, , , Sensitive Resources, Potential Oracle E-Business Suite Data (as claimed in extortion emails), , Financial Records, Personal Records, ERP Data, , Internal Corporate Data, Customer Information, Financial Records, Personal Data, , Personal data of donors, students, and prominent individuals, Sensitive personal identifiable information, 3,489,274 records and Sensitive personally identifiable information.
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident was MICROS Point-of-Sale Systems and and Legacy Servers and legacy Cerner data migration servers and Login ServersLegacy Cerner Data and Gen 1 serverslegacy systems and cloud-based property management systemsguest messaging platformsauthentication systems and Oracle E-Business Suite (potential) and Oracle E-Business Suite and and Oracle E-Business Suite and Oracle E-Business Suite (EBS) with unpatched BI Publisher Integration and Oracle E-Business Suite and and Oracle E-Business Suite (Versions 12.2.3–12.2.14)Runtime UI ComponentBI Publisher IntegrationConcurrent Processing Component and Oracle E-Business Suite (Versions 12.2.3–12.2.14)Internal Corporate Systems and Oracle E-Business Suite (EBS) ServersEnterprise Resource Planning (ERP) Systems and and and .
Response to the Incidents
What third-party assistance was involved in the most recent incident ?
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was okta threat intelligence (analysis by moussa diallo), , mandiant (google cloud), gtig, , mandiant (google cloud), google threat intelligence group (gtig), , mandiant (google cloud), , google mandiant (investigation and advisory), , crowdstrike (detection and analysis), mandiant (investigation), google threat intelligence group (gtig), , google security researchers, , aha’s preferred cybersecurity provider program, microsoft (via rural health resiliency program), , google threat intelligence, mandiant, crowdstrike, , security researchers (the raven file), .
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Password Change Recommendation, monitoring for suspicious domain registrationsblocking known malicious domains, Emergency Patch Release (CVE-2025-61882)Advisory for Customer Mitigation, Patch release (CVE-2025-61882)Indicators of Compromise (IoCs) shared with customers, Patching CVE-2025-61882Disabling Exposed EBS Components, Immediate Software Patch Installation (Oracle’s E-Business Suite)Long-Term Cyber Incident Response Planning and Emergency Patching (CVE-2025-61884 & CVE-2025-61882)Urgent Advisory for Customers to Apply Updates.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Personal Information, JPS keys, Large amounts of data (exact scope undisclosed), Encrypted SSO passwords, guest personal information, Potentially PII or Corporate Data, Potential Oracle E-Business Suite Data (as claimed in extortion emails), Key files, email addresses, LDAP credentials, Personal Data, Sensitive personally identifiable information, Financial Records, 3,489,274 records, Employee HR Files, Customer Information, hashed passwords, Potentially Finance, HR, and Supply Chain Data (Oracle E-Business Suite), Customer Data, Employee HR files, Electronic Health Records (EHR), operational data, ERP Data, Personal data of donors, students, and prominent individuals, Personal Records, Credit Card Payment Information, Names, Internal Corporate Data, payment data, Enterprise Manager JPS keys, Sensitive personal identifiable information, Sensitive Resources, Corporate Executive Data, SSO credentials, usernames, Customer data, Sensitive Corporate Data, SSO passwords, Sensitive Documents, JKS files, booking system credentials, Java Keystore files, Personal information of corporate executives and Social Security Numbers.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 25.0M.
Ransomware Information
What was the highest ransom demanded in a ransomware incident ?
Highest Ransom Demanded: The highest ransom demanded in a ransomware incident was Extortion Emails Sent (Amount Unspecified).
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Potential for Mass Extortion Campaigns Leveraging Stolen Credentials.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Educate employees and customers about malvertising and phishing risks., Implement adaptive risk assessments to detect anomalous access patterns., Restrict access to property management systems with zero-trust principles., Develop and Maintain a Comprehensive Cyber Incident Response Plan, Monitor for indicators of compromise (IOCs) linked to Clop’s infrastructure (e.g., 96 IPs, support@pubstorm[.]com), Monitor networks for indicators of compromise (IoCs) provided by Google., Deploy behavioral analytics to detect beaconing and tracking scripts., Review and Secure Default Password Reset Mechanisms, Implement behavioral analysis for XSLT injection attempts, Change Passwords, Investigate Oracle E-Business Suite environments for unusual access or compromise, Participate in Free or Discounted Cybersecurity Assessments (e.g., Microsoft’s Rural Health Resiliency Program), Collaborate with threat intelligence providers (e.g., Okta) for IOCs., Restrict internet exposure of EBS applications and enforce authentication controls., Educate employees about phishing and extortion email tactics., Implement Multi-Factor Authentication (MFA) for Oracle EBS, Prepare for extortion attempts if using Oracle EBS, given Clop’s history of targeting such vulnerabilities., Assess potential links to FIN11/Clop ransomware activity, Advocate for Federal and Allied Nation Interventions to Deter Cyber Adversaries, Immediate patching of CVE-2025-61882 for Oracle EBS versions 12.2.3–12.2.14, Enhance authentication mechanisms for OA_HTML endpoints, Conduct regular security audits for enterprise software., Monitor for signs of data exfiltration, especially via BI Publisher components., Request a fraud alert or credit report from major credit bureaus, Enhance logging and network segmentation for Oracle EBS environments., Install Immediate Patches for Oracle’s E-Business Suite and Other Critical Systems, Review Mandiant's advisory for additional mitigation strategies., Install Oracle's patch for CVE-2025-61882 immediately, Seek legal help to understand rights and pursue compensation, Segment networks to limit lateral movement, Monitor for suspicious domain registrations (e.g., typosquatting)., Monitor for Signs of Exploitation (e.g., Unusual Database Activity, Extortion Emails), Monitor for IoCs, including the listed IP addresses (200.107.207[.]26, 185.181.60[.]11) and exploit artifacts., Strengthen Public-Private Partnerships to Share Threat Intelligence and Best Practices, Engage threat intelligence services (e.g., CrowdStrike, Mandiant) for proactive detection., Monitor financial statements for suspicious activity, Invest in Training and Certifications for IT Staff, Particularly in Rural Healthcare Settings, Immediately apply Oracle's emergency patch for CVE-2025-61882., Enhance security for executive personal data, Monitor systems for Indicators of Compromise (IoCs) provided by Oracle, Segment Networks to Limit Lateral Movement, Immediately patch CVE-2025-61882 in Oracle E-Business Suite environments., Adopt phishing-resistant authentication (e.g., passkeys, FIDO2 WebAuthn)., Immediately patch Oracle E-Business Suite to the latest version., Implement multi-factor authentication (MFA) for all critical systems., Plan for Clinical Continuity During Cyber Disruptions, Engage Third-Party Threat Intelligence for Indicators of Compromise (IOCs), Monitor for high-volume extortion email campaigns from compromised accounts, Sign up for free IDX identity theft protection services, Review third-party vulnerability disclosures for proactive patching, Enhance Security Measures, Conduct forensic investigations to detect signs of prior exploitation., Leverage AHA’s Cybersecurity Resources, Including Preferred Provider Programs and Advisory Services and Apply Oracle Security Alerts and Critical Patch Updates Immediately.
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are Google Mandiant (Charles Carmakal, CTO) - LinkedIn Post, Emsisoft (MOVEit Impact Report), Okta Threat Intelligence (contributor: Moussa Diallo), LinkedIn Post by Charles Carmakal (Mandiant CTO), THE RAVEN FILE (Security Research), watchTowr Labs (PoC Analysis), American Hospital Association (AHA) Cybersecurity and Risk Webpage, Clop Dark Web Leak Site, SecurityAffairs, BleepingComputer Article, U.S. State Department Reward Program, Oracle Security Alert (October 2025), Mandiant (Google Cloud) Alert on Cl0p Campaign, Recorded Future News, CISA Advisory (January 2023 Oracle Incident), Mandiant/GTIG Warning, Google Blog Post, Attorney General of the Commonwealth of Massachusetts, Clop Ransomware Dark Web Leak Site, Mandiant (Google Cloud) & GTIG Analysis, BleepingComputer, Oracle Security Alert Advisory, Google Threat Intelligence & Mandiant Analysis, SEC Filing (8-K), TechCrunch, University of Phoenix Official Website, Oracle Security Advisory (Rob Duhart, CSO), Oracle Security Advisory, Oracle Security Advisory (CVE-2025-61882), Cyber Incident Description, News Article, CrowdStrike Blog, Shamis & Gentile P.A., AHA and Microsoft Rural Health Resiliency Program, THE RAVEN FILE Security Researchers, Oracle Security Alert (CVE-2025-61882), California Office of the Attorney General, U.S. State Department Rewards for Justice Program (Clop), FBI Warning on Oracle E-Business Suite Vulnerability and CrowdStrike Report on CVE-2025-61882 Exploitation.
What is the most recent URL for additional resources on cybersecurity best practices ?
Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://www.state.gov/rewards-for-justice-program/, https://www.cisa.gov/, https://techcrunch.com/2023/10/05/google-clop-oracle-zero-day-hack/, https://blog.google/threat-analysis-group/clop-oracle-zero-day/, https://www.oracle.com/security-alerts/, https://www.aha.org/cybersecurity, https://securityaffairs.co/wordpress/150000/hacking/oracle-ebs-flaw-cve-2025-61884.html .
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing.
Stakeholder and Customer Advisories
What was the most recent stakeholder advisory issued ?
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was warn customers about impersonation attempts, share indicators of compromise (IOCs) with industry peers, Mandiant/GTIG Warning to Corporate Executives, Oracle and Mandiant have issued public advisories urging immediate action., Oracle customers urged to patch immediately, Executives warned about extortion emails, Oracle Urgent Patching Advisory, CrowdStrike Threat Assessment, Oracle and Google have issued advisories with technical details for detection and mitigation., AHA provides timely alerts and advisories to member hospitals and health systems, incorporating input from federal law enforcement and AHA cybersecurity experts (John Riggi and Scott Gee)., Oracle Customers Urged to Patch Immediately, Executives Warned About Extortion Emails, Notification letters mailed to affected individuals, public disclosure on website, .
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued were an Oracle urged Micros customers to change their passwords and any passwords used by Micros representatives to access their on-premise systems., Private letters to customers, avoid clicking on sponsored search ads for hospitality servicesverify URLs before entering credentialsreport suspicious login pages, Recommended: Investigate Oracle E-Business Suite for compromise, Customers advised to patch and investigate potential compromise., Patch installation guidanceIoCs for detecting compromise, Extortion Emails from Clop to Executives, Organizations using Oracle E-Business Suite advised to apply patches and monitor for suspicious activity., Patients and the public are advised to stay informed about potential disruptions to healthcare services and to report suspicious activities. Hospitals are encouraged to communicate transparently with patients about cybersecurity measures and any impacts on care delivery., Apply Emergency Patches for CVE-2025-61884 and CVE-2025-61882Monitor for Suspicious Activity, Extortion emails sent to victims via support@pubstorm[.]com, 24 months of complimentary credit monitoring services provided to affected individuals, Free identity protection services offered (credit monitoring, identity theft recovery, dark web monitoring, $1 million fraud reimbursement policy), Affected individuals notified via written notice on Dec. 22 and 2025.
Initial Access Broker
What was the most recent entry point used by an initial access broker ?
Most Recent Entry Point: The most recent entry point used by an initial access broker were an CVE-2021-35587, Oracle E-Business Suite (EBS) zero-day vulnerability (CVE-2025-61882), Exploitation of Unpatched Vulnerability in Oracle’s E-Business Suite, OA_HTML/SyncServlet (Authentication Bypass) & OA_HTML/RF.jsp (XSLT Injection), Zero-Day Vulnerability in Oracle E-Business Suite (Network-Based, No Authentication Required), CVE-2025-61882 (Oracle E-Business Suite zero-day), Phishing (duping school employees), Oracle E-Business Suite Concurrent Processing Component (via HTTP) and Compromised Email Accounts.
What was the most recent reconnaissance period for an incident ?
Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was Likely conducted prior to August 2025 (exploitation began in August), Potentially since early August 2025 (zero-day exploitation), Since at least 2023-07-10, Potentially Began on 2025-07-10 (Prior to July Patches), Observed as early as June 2025, active exploitation from August 2025, Likely conducted prior to August 2025 (exploitation start date).
Post-Incident Analysis
What was the most significant root cause identified in post-incident analysis ?
Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Vulnerable software version, compromised subdomain, Over-reliance on traditional MFA methods vulnerable to real-time phishing.Lack of visibility into malvertising campaigns targeting brand impersonation.Insufficient monitoring for typosquatted domains and beaconing activity., Zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite.Lack of authentication requirements for exploitation.High-volume email campaign leveraging compromised accounts (per Mandiant)., Zero-day vulnerability (CVE-2025-61882) in Oracle E-Business SuiteInsufficient proactive patching for prior vulnerabilities (July 2025 patches bypassed), Unpatched Oracle EBS vulnerability (CVE-2025-61882)Internet-exposed EBS applications without authentication safeguardsDelayed patching despite active exploitation, Unpatched Zero-Day Vulnerability in Oracle E-Business SuiteInadequate Initial Response by Oracle (Premature Claim of Patch Effectiveness)Lack of Network Segmentation or Access Controls to Limit Exploitation, Unpatched Critical Vulnerability in Oracle’s E-Business SuiteInsufficient Cybersecurity Resources in Some Healthcare Organizations (e.g., Rural Hospitals)Sophisticated and Evolving Tactics by Cybercriminals and Nation-State Actors, Unpatched Vulnerabilities in Oracle E-Business SuiteLack of Authentication for Remote ExploitationPotential Weaknesses in Default Password Reset MechanismsDelayed Patch Deployment by Some Customers, Zero-Day Exploit (CVE-2025-61882)Delayed Patch Release (exploited for months pre-patch)Reused Attack Infrastructure from MOVEit (CVE-2023-34362), Unpatched zero-day vulnerability (CVE-2025-61882) in Oracle EBSLack of pre-authentication protections for SyncServlet endpointReuse of attack infrastructure from prior campaigns (e.g., MOVEit CVE-2023-34362), Software VulnerabilityPhishing, Exploitation of zero-day vulnerability in Oracle E-Business Suite (CVE-2025-61882).
What was the most significant corrective action taken based on post-incident analysis ?
Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Replace SMS/email-based MFA with phishing-resistant alternatives.Proactively register defensive domains to prevent typosquatting.Enhance threat intelligence sharing within the hospitality sector.Deploy solutions to detect and block malicious ads in search results., Emergency patch release by Oracle.Public disclosure and customer advisories.Collaboration with Mandiant for threat intelligence sharing., Patch deploymentCustomer advisory for IoC monitoring, Apply Oracle’s security patch for CVE-2025-61882.Implement network segmentation for EBS environments.Deploy behavioral detection for RCE attempts (e.g., CrowdStrike Falcon).Conduct threat hunting for signs of Clop or GRACEFUL SPIDER activity., Oracle Released Emergency Patches and AdvisoriesGoogle Shared Detection Indicators for Affected OrganizationsRecommended Enhanced Monitoring for Extortion Emails and Unusual Data Access, Mandatory Patch Management Protocols for Critical SoftwareEnhanced Collaboration Between Healthcare Providers, Government Agencies, and Cybersecurity FirmsExpanded Access to Cybersecurity Training and Resources for Under-Resourced OrganizationsDevelopment of Offensive Cyber Capabilities to Disrupt Adversaries Proactively, Oracle Released Out-of-Band PatchesCustomers Advised to Apply Patches and Monitor SystemsEnhanced Threat Intelligence Sharing (e.g., POC Disclosure as IOC), Patch deployment (October 2025)Infrastructure monitoring for 96 linked IPs (41 subnets reused from MOVEit).
.png)
Latest Global CVEs (Not Company-Specific)
Description
Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of CPU time. This issue has been patched in version 3.26.2 and 4.1.2.
Risk Information
cvss3
Base: 5.3
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Description
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount. An attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node's filesystem (where the KEDA pod resides) by directing the file's content to a server under their control, as part of the Vault authentication request. The potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd. This issue has been patched in versions 2.17.3 and 2.18.3.
Risk Information
cvss4
Base: 8.2
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses. This issue has been patched in versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/fedify-dev/fedify/commit/2bdcb24d7d6d5886e0214ed504b63a6dc5488779
- https://github.com/fedify-dev/fedify/commit/bf2f0783634efed2663d1b187dc55461ee1f987a
- https://github.com/fedify-dev/fedify/releases/tag/1.6.13
- https://github.com/fedify-dev/fedify/releases/tag/1.7.14
- https://github.com/fedify-dev/fedify/releases/tag/1.8.15
- https://github.com/fedify-dev/fedify/releases/tag/1.9.2
- https://github.com/fedify-dev/fedify/security/advisories/GHSA-rchf-xwx2-hm93
Description
Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a theme file (e.g., home.php).
Risk Information
cvss3
Base: 6.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Description
An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. The GetStreamUri exposes RTSP URIs containing hardcoded credentials enabling direct unauthorized video stream access.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=oracle-university' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
