Nearly 30 Alleged Victims of Oracle EBS Hack Named on Cl0p Ransomware Site

Cybercriminals have named nearly 30 organizations allegedly impacted by the recent Oracle EBS hack, with the Cl0p leak site listing twenty-nine alleged victims to date. The campaign, which involved extortion emails to executives in late September, is believed to have been conducted by a cluster of a profit‑driven threat actor tracked as FIN11, and the attacks were claimed by the Cl0p ransomware group.

The first organisations named included Harvard University, South Africa’s Wits University, and Envoy Air, an American Airlines subsidiary, with other high‑profile entities such as Logitech, Cox Enterprises, Pan American Silver, LKQ Corporation, and Copeland also cited among the alleged victims. The Washington Post confirmed it had been targeted, though it did not share details, and Reuters reported on 6 November 2025 that the newspaper was among victims.

SecurityWeek notes that many other alleged victims have yet to confirm a data breach, and the leak analysis suggests the data likely originated from an Oracle EBS environment; potential exploited CVEs include CVE-2025-61882 and CVE-2025-61884. According to Reuters.