Washington Post notifies 10,000 individuals affected in Oracle-linked data theft

The Washington Post has warned that 10,000 staff and contractors were affected by an Oracle E-Business Suite breach, with personal and financial data exposed. Between 10 July 2025 and 22 August 2025, threat actors accessed parts of the Post’s network by exploiting a zero‑day Oracle flaw tracked as CVE-2025-61884, according to the data breach notification sent to affected individuals and shared with the Maine Attorney General.

In late September, the Clop ransomware group attempted extortion, and in mid‑October it claimed the breach of The Washington Post and added the paper to its Tor data leak site, with claims that the incident stemmed from neglect of security. The Post confirmed that certain data was accessed and acquired without authorisation during that period, and it provided 12 months of free identity protection for affected individuals, advising them to freeze credit files and enable fraud alerts. Harvard University and Envoy Air are among other confirmed victims cited in the broader Oracle EBS incident.