---
title: Hackers Target Oracle E-Business Suite Users in Mass Extortion Campaign
description: Cybercriminals linked to Cl0p ransomware threaten companies with data breaches from Oracle E-Business Suite, raising global security concerns.
canonical_url: https://codekeeper.co/ticker/cl0p-ransomware-oracle-data-breach-threat
---

# Hackers Target Oracle E-Business Suite Users in Mass Extortion Campaign

Cybercriminals linked to Cl0p ransomware threaten companies with data breaches from Oracle E-Business Suite, raising global security concerns.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Oct 2, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcl0p-ransomware-oracle-data-breach-threat%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcl0p-ransomware-oracle-data-breach-threat%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcl0p-ransomware-oracle-data-breach-threat%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcl0p-ransomware-oracle-data-breach-threat%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcl0p-ransomware-oracle-data-breach-threat%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcl0p-ransomware-oracle-data-breach-threat%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Cybercriminals claiming ties to the notorious Cl0p ransomware group are extorting executives at numerous companies, alleging they've stolen sensitive data from Oracle E-Business Suite systems. The campaign began around September 29, using hundreds of compromised email accounts linked to the FIN11 cybercrime gang. Google's Threat Intelligence Group and Mandiant are investigating but can't yet verify the hackers' claims. Oracle E-Business Suite is used by thousands of organizations worldwide to manage business operations, making this a potentially massive security incident. Both Cl0p and FIN11 have history with similar attacks, previously exploiting zero-day vulnerabilities in MOVEit, Cleo, and other file transfer tools to steal data from millions of users across thousands of companies. **Source:** [SecurityWeek](https://www.securityweek.com/cybercriminals-claim-theft-of-data-from-oracle-e-business-suite-customers/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcl0p-ransomware-oracle-data-breach-threat%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcl0p-ransomware-oracle-data-breach-threat%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcl0p-ransomware-oracle-data-breach-threat%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcl0p-ransomware-oracle-data-breach-threat%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcl0p-ransomware-oracle-data-breach-threat%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcl0p-ransomware-oracle-data-breach-threat%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[CISA Warns of Actively Exploited Zero-Day in Cisco Firewall Management Center Aug 11, 2026](https://codekeeper.co/ticker/cisa-warns-zero-day-flaw-cisco-fmc)

[Cyberattacks Jordan Detains Alleged ShinyHunters Leader Oct 6, 2026](https://codekeeper.co/ticker/teen-hacker-rey-arrested-cooperates-with-fbi)

[Cyberattacks Spy Campaign on Ukraine Traced to North Korea-Linked Hackers Oct 14, 2026](https://codekeeper.co/ticker/north-korean-hackers-target-ukraine)

[Settra Joins Qilin in Exploiting Palo Alto VPN Flaw Patched in May Oct 12, 2026](https://codekeeper.co/ticker/ransomware-exploit-palo-alto-vpn-vulnerability)