Harvard hit in Oracle EBS cyberattack, 1.3 TB of data leaked by Cl0p group

Harvard University confirmed it was targeted in the Oracle E-Business Suite campaign after the Cl0p ransomware group listed it on its leak site, claiming to have leaked 1.3 TB of data. The university says there is no evidence of other systems being compromised and notes that the leaked material includes financial, HR, customer, supplier, and inventory information, though the level of sensitivity varies by victim.

Google Threat Intelligence Group (GTIG) and Mandiant reported dozens of organisations were targeted in the extortion campaign, with attackers exploiting July-patched EBS flaws and likely a zero-day, CVE-2025-61882, to access data. Oracle released an emergency security update for CVE-2025-61882 in its E-Business Suite, which CrowdStrike attributed to the Cl0p group with moderate confidence.

The Clop group’s activity involved extortion emails to executives and the use of hundreds of hacked accounts, as described by Mandiant’s CTO Charles Carmakal.