Harvard Is First Confirmed Victim of Oracle EBS Zero-Day Hack

Harvard University is the first confirmed victim in a cybercrime campaign targeting Oracle’s E-Business Suite (EBS), with hackers posting over 1.3 TB of allegedly stolen Harvard data on the Cl0p data leak site. The university was added to the leak list on October 12, and the article notes Harvard’s own statement that the vulnerability exploited has been patched and that only a limited number of parties associated with a small administrative unit are affected.

The operation is linked to Cl0p and, according to Google’s Threat Intelligence Group (GTIG) and Mandiant, there are connections to the FIN11 group, though no single group has been officially attributed. Exploitation is described as involving known and zero-day vulnerabilities alongside sophisticated malware, with CrowdStrike reporting that the attacks began as early as July 10 and may have started on August 9.

The data could vary in sensitivity between victims, and extortion emails were sent to executives on behalf of Cl0p. Harvard emphasises that its investigation is ongoing and that no other systems have evidence of compromise.