Oracle EBS Attack Victims May Be More Numerous Than Expected

Oracle EBS victims may be more numerous than previously thought, with evidence suggesting Schneider Electric, Pan American Silver, and Cox Enterprises could be affected, alongside other organisations attacked via the Oracle EBS zero-day CVE-2025-61882. Earlier this month, the Clop ransomware-as-a-service gang targeted customers affected by the vulnerability, which allows unauthenticated remote access to Oracle Concurrent Processing and can lead to data theft and extortion.

Based on Clop’s data leak site and researcher posts, Harvard University has confirmed attacks, and industry giants such as Schneider Electric, Cox Enterprises, and Pan American Silver have been added to Clop’s leak site as part of these campaigns. Google Threat Intelligence Group has suggested possible involvement from FIN11, but this attribution remains unconfirmed pending more concrete evidence.

Patches for CVE-2025-61882 are available, and Oracle strongly advised vulnerable customers to apply the updates as soon as possible, with the FBI Cyber Division stressing the urgency to patch to prevent full compromise for exposed environments. The exact blast radius remains uncertain as Clop continues to add names to its leak site, and only a few organisations have publicly disclosed attacks. according to the FBI Cyber Division