securityweek.com
By Eduard Kovacs|
November 13, 2025 (7:54 AM ET)
The UK’s national healthcare system is working with the country’s National Cyber Security Centre to investigate the incident.
Cybercriminals have named the United Kingdom’s National Health Service (NHS) as one of the victims of the recent data theft and extortion campaign targeting organizations that use Oracle’s E-Business Suite (EBS) enterprise resource planning solutions.
“We are aware that the NHS has been listed on a cyber-crime website as being impacted by a cyber-attack, but no data has been published,” a spokesperson for NHS England told SecurityWeek. “Our cyber security team is working closely with the National Cyber Security Centre to investigate.”
The Oracle EBS hacking campaign came to light in early October and within two weeks the cybercriminals started naming victims on the Cl0p ransomware group’s leak website. The hackers have since made public data allegedly stolen from organizations such as Harvard University, American Airlines subsidiary Envoy Air, industrial giants Schneider Electric and Emerson, and The Washington Post.
The NHS is the latest organization named on the Cl0p ransomware leak website, which now lists more than 40 alleged victims of the Oracle EBS campaign. Data allegedly obtained from 25 targets has been published.
One of the victims named in recent days is Hitachi subsidiary GlobalLogic, a provider of digital engineering solutions.
GlobalLogic confirmed this week that the cybercriminals gained access to HR information for current and former employees, including names, addresses, contact information, dates of birth, passport information, Social Security numbers, salary information, and bank account details. The company said the incident impacts more than 10,000 individuals.
A majority of the organizations named on the Cl0p website have yet to confirm or deny being impacted. The list includes major companies such as Logitech, Cox Enterprises, Pan American Silver, LKQ Corporation, and Copeland.
Victims of the Oracle EBS hack are likely conducting investigations and some of them likely do not want to share information until their probes are completed. Others are likely trying to avoid the spotlight by staying silent.
While Cl0p’s history suggests that organizations are rarely listed as victims without cause, the actual scope of the breach may be exaggerated by the threat actors to pressure victims into payment.
| CyberScoop
cyberscoop.com
Written by Matt Kapko
November 13, 2025
The newspaper said a “bad actor” contacted the company in late September, prompting an investigation that nearly a month later confirmed the extent of compromise.
he Washington Post said it, too, was impacted by the data theft and extortion campaign targeting Oracle E-Business Suite customers, compromising human resources data on nearly 10,000 current and former employees and contractors.
The company was first alerted to the attack and launched an investigation when a “bad actor” contacted the media company Sept. 29 claiming they gained access to the company’s Oracle applications, according to a data breach notification it filed in Maine Wednesday. The Washington Post later determined the attacker had access to its Oracle environment from July 10 to Aug. 22.
The newspaper is among dozens of Oracle customers targeted by the Clop ransomware group, which exploited a zero-day vulnerability affecting Oracle E-Business Suite to steal heaps of data. Other confirmed victims include Envoy Air and GlobalLogic.
The Washington Post said it confirmed the extent of data stolen during the attack on Oct. 27, noting that personal information on 9,720 people, including names, bank account numbers and routing numbers, and Social Security numbers were exposed. The company didn’t explain why it took almost a month to determine the amount of data stolen and has not responded to multiple requests for comment.
Oracle disclosed and issued a patch for the zero-day vulnerability — CVE-2025-61882 affecting Oracle E-Business Suite — in a security advisory Oct. 4, and previously said it was aware some customers had received extortion emails. Mandiant, responding to the immediate fallout from the attacks, said Clop exploited multiple vulnerabilities, including the zero-day to access and steal large amounts of data from Oracle E-Business Suite customer environments.
Oracle, its customers and third-party researchers were not aware of the attacks until executives of alleged victim organizations received extortion emails from members of Clop demanding payment in late September. Cynthia Kaiser, senior vice president of Halcyon’s ransomware research center, previously told CyberScoop ransom demands reached up to $50 million.
Clop’s data-leak site included almost 30 alleged victims as of last week. The notorious ransomware group has threatened to leak alleged victims’ data unless it receives payment.
The ransomware group has intruded multiple technology vendors’ systems before, allowing it to steal data and extort many downstream customers. Clop specializes in exploiting vulnerabilities in file-transfer services and achieved mass exploitation in 2023 when it infiltrated MOVEit environments, ultimately exposing data from more than 2,300 organizations.
Le groupe informatique fait partie de la dizaine d’entreprises ciblées par les hackers de Clop, qui imposent un ultimatum de vingt-quatre heures.
Le groupe de hackers russe Clop a donné un ultimatum de vingt-quatre heures à Logitech.
Contacté ce vendredi en début d’après-midi, le siège du groupe à Lausanne «ne souhaite pas faire de commentaire à ce stade».
L’attaque vise une dizaine de grandes entreprises et institutions, dont le «Washington Post».
Le fabricant de périphériques informatiques Logitech figure parmi les cibles d’une vaste offensive perpétrée par le groupe de hackers Clop. Ce dernier en a fait l’annonce vendredi matin sur le dark web. Et indique avoir imposé un ultimatum de vingt-quatre heures au groupe helvético-américain, fondé en 1981 à Lausanne. En clair, ce dernier est sommé de payer une rançon, s’il ne veut pas voir les masses de données subtilisées sur ses serveurs disséminées sur le web.
Ces trois derniers jours, le groupe cybercriminel a mentionné une dizaine d’autres entreprises victimes de cette attaque. Mais également des institutions comme l’Université de Harvard ou le «Washington Post».
«Pas de commentaire» de Logitech
Contacté ce vendredi en début d’après-midi, le siège européen de Logitech indique qu’il «ne souhaite pas faire de commentaire à ce stade» sur cette offensive visant son système informatique.
«Attendons vingt-quatre heures pour voir de quoi il en retourne, Clop est l’un des acteurs les plus en vue de ces détournements de données et ils n’ont vraiment pas l’habitude de bluffer», réagit un fin connaisseur du dark web. «Peut-être Logitech essaie-t-il de gagner du temps, afin de négocier pour éviter que des masses de documents confidentiels ne soient rendus publics», s’interroge ce dernier.
La surveillance régulière de telles opérations a permis à cet expert de retrouver, depuis le début de l’année, des données volées provenant d’une quarantaine de sociétés suisses. Il s’agit avant tout de celles ayant refusé de payer face au chantage. «Au départ, elles étaient environ trois fois plus nombreuses à être désignées comme cibles, ce qui semble indiquer que près des deux tiers finissent malheureusement par payer», estime ce dernier.
Une brèche dans un logiciel mène à la cyberattaque
Selon les spécialistes, la vaste attaque des derniers jours aurait été perpétrée en utilisant la même «brèche» dans un logiciel professionnel Oracle. Après la revendication de Clop, le «Washington Post» a confirmé jeudi, sur Reuters, être victime d’une cyberattaque liée à une faille dans sa plateforme Oracle E-Business Suite (EBS).
Selon le site spécialisé TechNadu, ce logiciel est utilisé par les grandes entreprises pour «gérer leurs opérations commerciales critiques, la logistique, la production ou la gestion de la relation client». Les équipes de Google estimaient le mois dernier que cette campagne a visé une centaine d’entreprises dans le monde.
Souvent identifié par le pseudo Cl0p^_-Leaks, le groupe de «ransomware» russophone, un des plus anciens en activité, a été identifié en 2019. Il est spécialisé dans le racket de grandes sociétés – celles ayant le plus de moyens pour payer.
reuters.com
By Raphael Satter and A.J. Vicens
November 7, 20254:21 PM GMT+1Updated 22 hours ago
The Washington Post said it is among victims of a sweeping cyber breach tied to Oracle (ORCL.N), opens new tab software.
In a statement released on Thursday, the newspaper said it was one of those impacted "by the breach of the Oracle E-Business Suite platform."
The paper did not provide further detail, but its statement comes after CL0P, the notorious ransomware group, said on its website that the Washington Post was among its victims. CL0P did not return messages seeking comment. Oracle pointed Reuters to a pair of security, opens new tab advisories, opens new tab issued last month.
Ransom-seeking hackers typically publicize their victims in an effort to shame them into making extortion payments, and CL0P are among the world's most prolific. The hacking squad is alleged to be at the center of a sweeping cybercriminal campaign targeting Oracle's E-Business Suite of applications, which Oracle clients use to manage customers, suppliers, manufacturing, logistics, and other business processes.
Google said last month that there were likely to be more than 100 companies affected by the intrusions.
Key Findings The number of publicly-mentioned and extorted victims in Q1 reached the highest ever number, with a 126% increase year-over-year. Cl0p
L’année qui s’achève aura été notamment marquée par plusieurs campagnes d’exploitation de vulnérabilités inédites, en masse, par Cl0p, à des fins de cyberextorsion. Une première à cette échelle. L'...
The infamous Clop ransomware, mainly known as Cl0p, targets various industries and organizations, extorting data for a huge amount of ransom. It advances actively with new emerging campaigns. This blog walks through the Clop timeline, Mitre TTPs and their emulation.
Le groupe Cl0p a poursuivi la diffusion des données volées à Cegedim à l’occasion de sa campagne de cyberattaques contre les instances MOVEit Transfer. Il met désormais à disposition plus de 1,5 To de données.
Siemens Energy has confirmed that data was stolen during the recent Clop ransomware data-theft attacks using a zero-day vulnerability in the MOVEit Transfer platform.
Top U.S. cybersecurity officials confirmed Thursday that several federal agencies have been impacted by cyberattacks on the widely used MOVEit file transfer tool.
Cybersecurity and Infrastructure Security Agency (CISA) Director Jen Easterly told reporters that her team and the FBI are working to provide assistance to federal agencies that used MOVEit, which is being exploited by the Russia-based Clop ransomware gang in a widespread breach that appears to have compromised dozens of entities.
“We’ve been working closely with Progress Software [which makes MOVEit], the FBI and our federal partners to understand its prevalence within federal agencies,” she said. Earlier in the day, CNN first reported that several government agencies were compromised in the hacks. Easterly said that CISA is providing support to “several agencies that have experienced intrusions of their MOVEit applications.”
The hackers responsible for exploiting a flaw to target users of a popular file transfer tool has begun listing victims of the mass-attacks
Vulnerabilities in PaperCut printing management are being used in ransomware attacks.
Cyble Research & Intelligence Labs analyzes Cl0p ransomware which is rapidly gaining attention for its success in extorting businesses.
Ransomware groups are constantly devising new methods for infecting victims and convincing them to pay up, but a couple of strategies tested recently seem especially devious. The first centers on targeting healthcare organizations that offer consultations over the Internet and sending them booby-trapped medical records for the “patient.” The other involves carefully editing email inboxes of public company executives to make it appear that some were involved in insider trading.
A ransomware group has hit at least one water company in the United Kingdom, but there is some confusion over whose systems were actually breached.
