Cybercriminals Claim Theft of Data From Oracle E-Business Suite Customers

Cybercriminals are claiming to have stolen sensitive information from Oracle E-Business Suite customers, with extortion emails sent to executives at numerous organisations. The attackers say they are affiliated with the Cl0p ransomware group, and researchers have found links to FIN11, though the attackers’ claims have not been substantiated.

According to Google Threat Intelligence Group and Mandiant, the attacks appear to be a high‑volume email campaign using hundreds of compromised accounts and began on or around 29 September. There is some evidence linking the activity to Cl0p, including contact information in the emails that matches addresses listed on the Cl0p leak site, but attribution remains unconfirmed. Mandiant and GTIG said they are in the early stages of their investigations and could not confirm the veracity of the claims.

SecurityWeek notes that attribution in financially motivated cybercrime is often complex, with actors sometimes mimicking established groups to pressure victims.