Oracle Confirms Hackers Target E-Business Suite Data in Extortion Campaigns

Oracle has confirmed that a group of hackers stole data from its E-Business Suite (EBS) applications and is using the information in extortion campaigns, with victims receiving ransom notes and proofs of stolen records. The firm says the attackers exploited vulnerabilities that were already fixed in the July 2025 Critical Patch Update (CPU) and urges customers to apply the latest CPU immediately to defend against further intrusions.

Executives and IT teams at several large organisations have been targeted, with extortion emails claiming their EBS data was copied and demanding ransoms of up to $50 million to prevent public release; some notes show poor English and grammar, a characteristic noted by Halcyon, which is responding to incidents.

The campaign began sending threats on or before 29 September, using hundreds of compromised third‑party accounts, and one address used in notes was linked to a Cl0p affiliate, according to Genevieve Stark of Google Threat Intelligence Group. Oracle’s investigation is ongoing, and the company advises all EBS users to verify the July 2025 CPU has been applied and to review access logs, enforce strong multi‑factor authentication, and maintain offline backups to aid rapid recovery.