Oracle EBS zero-day used by Clop to breach Barts Health NHS

Clop ransomware stole data from Barts Health NHS after exploiting a zero-day in its Oracle E-Business Suite, specifically CVE-2025-61882, with the breach linked to the Oracle EBS zero-day being exploited since early August.

The exposed material includes invoices containing full names and addresses of patients, details of former employees with debts, and information on suppliers, as well as accounting files relating to services provided since April 2024, affecting sensitive financial and personal records across multiple years, according to cyberattack update.

The data breach occurred in August but was detected in November when the stolen files were posted on the dark web; the organisation noted that its electronic patient record and clinical systems were not affected. Barts Health NHS said the cybercrime group added the organisation to its dark web data leak site and leaked the stolen information, and that Oracle has since issued a security update to fix the flaw. The NHS trust notified the UK National Cyber Security Centre, Metropolitan Police, and the ICO about the breach.