---
title: Oracle Customers Hit by Extortion Emails After Vulnerability Exploits
description: Oracle's E-Business Suite users face extortion threats over alleged data theft, linked to Cl0p and FIN11, exploiting unpatched vulnerabilities.
canonical_url: https://codekeeper.co/ticker/oracle-ebusiness-suite-extortion-emails
---

# Oracle Customers Hit by Extortion Emails After Vulnerability Exploits

Oracle's E-Business Suite users face extortion threats over alleged data theft, linked to Cl0p and FIN11, exploiting unpatched vulnerabilities.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Oct 3, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-ebusiness-suite-extortion-emails%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-ebusiness-suite-extortion-emails%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-ebusiness-suite-extortion-emails%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-ebusiness-suite-extortion-emails%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-ebusiness-suite-extortion-emails%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-ebusiness-suite-extortion-emails%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Oracle confirmed that customers using its E-Business Suite software have received extortion emails claiming sensitive data theft. The company's investigation suggests attackers exploited known vulnerabilities that were patched in Oracle's July 2025 Critical Patch Update, which fixed around 200 flaws. Google Threat Intelligence and Mandiant researchers discovered the extortion campaign, with emails allegedly coming from the notorious Cl0p cybercrime group and sent from accounts linked to FIN11. While researchers haven't verified the hackers' theft claims, both groups have previously targeted enterprise software vulnerabilities. Oracle's July update addressed nine E-Business Suite vulnerabilities, including three remotely exploitable flaws without authentication and three high-severity issues. This follows Oracle's earlier admission that hackers stole data from a legacy cloud environment. **Source:** [SecurityWeek](https://www.securityweek.com/oracle-says-known-vulnerabilities-possibly-exploited-in-recent-extortion-attacks/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-ebusiness-suite-extortion-emails%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-ebusiness-suite-extortion-emails%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-ebusiness-suite-extortion-emails%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-ebusiness-suite-extortion-emails%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-ebusiness-suite-extortion-emails%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-ebusiness-suite-extortion-emails%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Data breaches Revolut Hit with $3M Ransom Demand After 5-Month Data Breach Sep 21, 2026](https://codekeeper.co/ticker/hackers-trick-revolut-for-crypto-whale-data)

[Cyberattacks Hackers Hit Three UK Airports, Stealing Data from 8.7 Million Customers Aug 31, 2026](https://codekeeper.co/ticker/mag-cyberattack-exposes-customer-data)

[Decades-Old Bash Tricks Leave AI Coding Agents Open to Supply Chain Attacks Aug 12, 2026](https://codekeeper.co/ticker/guardfall-flaw-in-ai-coding-agents)

[Japan's Military Unknowingly Used Chinese Malware-Infected USB Drives for Nearly a Year Aug 12, 2026](https://codekeeper.co/ticker/jgsdf-malware-infected-usb-drives-expose-classified-data)