Clop extortion emails claim theft of Oracle E-Business Suite data

DataBreaches[.]Net reports that executives at multiple companies received extortion emails claiming that sensitive data was stolen from Oracle E-Business Suite systems. According to Genevieve Stark, Head of Cybercrime and Information Operations Intelligence Analysis at GTIG, the campaign began in late September. She notes that “This activity began on or before September 29, 2025,” with Mandiant and Google tracking the effort, though the claims have not yet been substantiated.

The extortion emails are being sent from a large number of compromised email accounts, and the messages link to a CLOP-associated framing, with links and contact addresses publicly listed on the official CLOP data leak site. GTIG also indicates strong links to the financially motivated group FIN11, often associated with CLOP, including use of hundreds of compromised accounts and at least one account tied to past FIN11 activity, while emphasising that attribution remains complex and unconfirmed at this time. Organizations are advised to treat the emails seriously and investigate for any evidence of threat actor activity.