Industrial Giants Schneider Electric and Emerson Named as Victims of Oracle Hack

Industrial giants Schneider Electric and Emerson have been named by cybercriminals as victims of the Oracle E-Business Suite hack, with data allegedly stolen and publicly linked to them on the Cl0p ransomware leak site. The Cl0p leak contains links to 2.7 TB of archive files purportedly from Emerson and 116 GB allegedly belonging to Schneider Electric, and SecurityWeek’s investigation suggests the data likely originates from an Oracle environment.

The threat actors, believed to be a FIN11 cluster, have started naming victims and releasing some of the exfiltrated data. Major organisations such as Harvard University, Wits University in South Africa, and Envoy Air have publicly confirmed impact, while Schneider Electric and Emerson have not responded to SecurityWeek’s requests for comment.

Security researcher Dominic Alvieri independently confirmed that the leaked data was likely obtained through the Oracle EBS compromise, and the campaign has been linked to prior exploits against other targets. The article, dated 28 October 2025, notes that the attackers have previously claimed data losses in related campaigns and that these two firms had already faced earlier ransomware allegations. According to SecurityWeek, if confirmed, this would not be the first time both firms have been targeted by cybercriminals.