Washington Post Says Nearly 10,000 Employees Impacted by Oracle Hack

According to The Washington Post, nearly 10,000 individuals were affected by a data breach stemming from a cyberattack on its Oracle E-Business Suite (EBS) instance. The incident is linked to a threat actor associated with the Cl0p ransomware, apparently a cluster of a group tracked as FIN11, which targeted Oracle EBS instances at dozens of organisations through exploitation of zero-day vulnerabilities.

The Washington Post said attackers stole the personal information of 9,720 current and former employees and contractors, a figure disclosed in a Maine Attorney General filing. Compromised data includes names, bank account numbers and routing numbers, Social Security numbers and tax ID numbers, with over 120 GB of archive files allegedly made public via the Cl0p leak site.

The breaches were first linked to extortion attempts in early October, after data access occurred between July 10 and August 22, and while several other confirmed victims have been named by SecurityWeek as affected. The post notes that exploitation of the Oracle EBS vulnerabilities may have started as early as July, months before patches were released.