Law09/24/2026@LawDesk
Oracle E-Business Suite Breach Suits Consolidated in Austin
United States Courthouse, 501, West 5th Street, Warehouse District, Austin, Travis County, Texas, 78701, United StatesOracle
Starts 01/05/2026CONFIRMED 86% CONFIDENCE263 days agoThe order in No. 1:25-cv-01805-ADA-SH is 'SIGNED on January 5, 2026' by Susan Hightower, United States Magistrate Judge.^[1]
A federal magistrate judge combined 33 class actions over the Cl0p theft of Oracle E-Business Suite data into In re Oracle Corporation Data Breach Litigation.
0.76
Cybersecurity09/24/2026@CyberDesk
Hacker Claims Theft of 6 Million Oracle Cloud Login Records
Oracle2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United States
Starts 03/20/2025CONFIRMED 89% CONFIDENCE1.5 years agoBleepingComputer^[1][2][3] (21 March 2025) says rose87168 'released multiple text files yesterday', and its 3 April follow-up says the 6 million records went on sale on BreachForums 'on March 20'.
A hacker called rose87168 put 6 million records up for sale that they said came from Oracle Cloud's single sign-on login servers; Oracle denied any breach of Oracle Cloud.
0.69
Cybersecurity09/24/2026@CyberDesk
Oracle Issues Emergency Patch for E-Business Suite Zero-Day CVE-2025-61882
2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle
Starts 10/04/2025CONFIRMED 88% CONFIDENCE356 days agoOracle's^[1][2] Security Alert Advisory CVE-2025-61882 lists '2025-October-04 Rev 1. Initial Release' in its modification history.
Oracle's out-of-band Security Alert fixed a 9.8-rated, no-login remote code execution flaw in E-Business Suite that Cl0p had exploited to steal data.
0.69
Cybersecurity09/24/2026@CyberDesk
FBI Flash Warns UNC6040 and UNC6395 Are Raiding Salesforce Instances
J. Edgar Hoover Building, 935, Pennsylvania Avenue Northwest, Penn Quarter, Ward 2, Washington, District of Columbia, 20535, United StatesFederal Bureau of Investigation
Starts 09/12/2025CONFIRMED 89% CONFIDENCE1.0 years agoThe FBI's TLP:CLEAR alert is headed '12 September 2025' with FLASH number 'FLASH-20250912-001'.^[1]
The FBI published indicators for two crews stealing companies' Salesforce data, one by phoning staff posing as IT support, the other with stolen Salesloft Drift tokens.
0.66
Cybersecurity09/24/2026@CyberDesk
Scattered Lapsus$ Hunters Open a Leak Site to Extort Salesforce
Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce
Starts 10/03/2025CONFIRMED 88% CONFIDENCE357 days agoBleepingComputer's^[1][2][3] report dated 'October 3, 2025' says 'Today, they launched a new data leak site containing 39 companies' with an 'October 10 deadline'.
The gang posted samples from 39 companies' stolen Salesforce data and told Salesforce to pay by 10 October or see about a billion records leaked.
0.65
Cybersecurity09/24/2026@CyberDesk
Google Exposes UNC6040's Vishing Raids on Salesforce Customers
SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States
Starts 06/04/2025CONFIRMED 88% CONFIDENCE1.3 years agoThe Google^[1] Cloud Threat Intelligence post 'The Cost of a Call: From Voice Phishing to Data Extortion' is dated 'June 4, 2025'.
Google's threat researchers said a crew posing as IT support on the phone was talking employees into approving a fake Data Loader app, then bulk-stealing their companies' Salesforce data for extortion.
0.65
Cybersecurity09/24/2026@CyberDesk
Salesforce Warns of Mass Theft From Misconfigured Experience Cloud Sites
SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States
Starts 03/07/2026 10:48PMCONFIRMED 85% CONFIDENCE202 days agoSalesforce^[1] Security's post is dated 'March 7, 2026' (published 22:48 UTC); FINRA^[2]: 'On March 7, 2026, Salesforce reported that ShinyHunters was actively exploiting misconfigured Experience Cloud guest user profiles.'
Salesforce said a known threat group was mass-scanning public Experience Cloud sites with a modified Mandiant tool and pulling CRM data through overly permissive guest user profiles.
0.64
Cybersecurity09/24/2026@CyberDesk
Oracle Issues Emergency Fix for PeopleSoft Zero-Day Hit by ShinyHunters
2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle
Starts 06/10/2026CONFIRMED 88% CONFIDENCE107 days agoOracle's^[1] Security Alert Advisory CVE-2026-35273 lists '2026-June-10 Rev 1. Initial Release' in its modification history.
Oracle's Security Alert for CVE-2026-35273, a 9.8-rated no-login remote code execution flaw in PeopleSoft PeopleTools, came as ShinyHunters stole data from over 100 organizations, mostly universities.
0.64
Cybersecurity09/24/2026@CyberDesk
CISA Orders Federal Agencies to Patch Oracle E-Business Suite Zero-Day
2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle
10/06/2025 - 10/27/2025CONFIRMED 90% CONFIDENCE354 days agoCISA's^[1][2] alert of 'October 06, 2025' adds 'CVE-2025-61882 Oracle^[4] E-Business Suite Unspecified Vulnerability'; the KEV catalog entry sets dateAdded 2025-10-06 and dueDate 2025-10-27 under BOD 22-01, which 'requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date'.
CISA put CVE-2025-61882 on its Known Exploited Vulnerabilities list, giving federal civilian agencies until 27 October 2025 to fix Oracle E-Business Suite.
0.63
Cybersecurity09/24/2026@CyberDesk
Oracle Health Breach of Legacy Cerner Servers Exposes Patient Data
OracleCerner Corporation, North Kansas City, Clay County, Missouri, 64117, United States
Starts 03/28/2025CONFIRMED 89% CONFIDENCE1.5 years agoBleepingComputer^[1][3], 28 March 2025: 'A breach at Oracle Health impacts multiple US healthcare organizations and hospitals', reported from Oracle Health's notice to customers while 'Oracle Health has not yet publicly disclosed the incident'.
Attackers copied patient data from old Cerner data-migration servers that Oracle Health had not yet moved to Oracle Cloud, and US hospitals were then extorted over it.
0.62
Cybersecurity09/24/2026@CyberDesk
Hackers Dump Qantas and Vietnam Airlines Data After Salesforce Deadline
QantasQantas Group Headquarters, 10, Bourke Road, Mascot, Sydney, New South Wales, 2020, Australia
Starts 10/11/2025 3:30AMCONFIRMED 87% CONFIDENCE349 days agoInformation Age: 'The data was first leaked to a clear-web hacking forum at approximately 2.30pm AEDT Saturday' (11 October 2025), about an hour before it went up free on the dark web.^[1]
When the ransom deadline passed, Scattered Lapsus$ Hunters published stolen Salesforce data of six companies, including 5 million Qantas customer records and 7.3 million Vietnam Airlines email addresses.
0.62
Cybersecurity09/24/2026@CyberDesk
Hackers Use Stolen Salesloft Drift Tokens to Raid Salesforce Instances
SalesloftAtlanta, Fulton County, Georgia, United States
08/08/2025 - 08/18/2025CONFIRMED 87% CONFIDENCE1.1 years agoGTIG: 'Beginning as early as Aug. 8, 2025 through at least Aug. 18, 2025, the actor targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft^[2] Drift third-party application.'
Using OAuth tokens stolen from Salesloft's Drift chatbot, the UNC6395 crew exported data from hundreds of companies' Salesforce instances, hunting support cases for AWS keys, passwords and Snowflake tokens.
0.62

Google^[1] Threat Intelligence Group: 'Beginning Sept. 29, 2025, Google Threat Intelligence Group (GTIG) and Mandiant began tracking a new, large-scale extortion campaign by a threat actor claiming affiliation with the CL0P extortion brand.'

Start: Sep 29, 202590% CONFIDENCEfrom the source

Cl0p Starts Emailing Executives Claiming Oracle E-Business Suite Data Theft

A group using the Cl0p extortion brand began mass-emailing executives, saying it had stolen data from their companies' Oracle E-Business Suite systems and demanding payment.

Beginning 29 September 2025, a threat actor claiming the CL0P brand sent a high volume of emails to executives at numerous organizations, alleging it had stolen sensitive data from their Oracle E-Business Suite (EBS) environments^[1].
Mandiant CTO Charles Carmakal said the emails came from hundreds of compromised accounts, at least one previously associated with FIN11; the email read "We are CL0P team... We have recently breached your Oracle E-Business Suite application and copied a lot of documents"^[4].
On 2 October Oracle's chief security officer Rob Duhart said some EBS customers had received extortion emails and that its investigation pointed to vulnerabilities addressed in the July 2025 Critical Patch Update^[3].
Google's analysis found the campaign followed months of intrusions: what may be CVE-2025-61882 was exploited as a zero-day as early as 9 August 2025, with suspicious activity back to 10 July, and some victims lost significant amounts of data^[1].
The Washington Post later said it was contacted by the attacker on 29 September and that personal data of 9,720 current and former employees and contractors was taken between 10 July and 22 August^[2].

@CyberDesk

References 487% CONFIDENCE

The first entry is always the pin's source. Overall confidence is a weighted average of how firmly each reference supports the start and end times used above; a reference counts half as much for every 180 days older than the newest.

[1]90%
cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation
cloud.google.com· Posted Sep 24, 2026· Starts Sep 29, 2025 ✓· 55% of score
Google Threat Intelligence Group: 'Beginning Sept. 29, 2025, Google Threat Intelligence Group (GTIG) and Mandiant began tracking a new, large-scale extortion campaign by a threat actor claiming affiliation with the CL0P extortion brand.'
[2]82%
Washington Post Says Nearly 10,000 Employees Impacted by Oracle Hack
securityweek.com· Published Nov 14, 2025· 17% of score
The Washington Post's Maine Attorney General filing: contacted by the attacker on 29 September, data accessed 10 July to 22 August, 9,720 people affected.^[1]
[3]84%
Oracle links Clop extortion attacks to July 2025 vulnerabilities
bleepingcomputer.com· Published Oct 3, 2025· 14% of score
Oracle CSO Rob Duhart confirmed some E-Business Suite customers received extortion emails and pointed to flaws fixed in the July 2025 Critical Patch Update.^[1]
[4]85%
Clop extortion emails claim theft of Oracle E-Business Suite data
bleepingcomputer.com· Published Oct 1, 2025· 14% of score
Quotes GTIG's Genevieve Stark that the activity began 'on or before September 29, 2025' and Mandiant's Charles Carmakal on emails sent from hundreds of compromised accounts, one linked to FIN11.^[1]

Suggest a correction

Something missing or wrong? Say it in your own words: a link that backs this pin up, a different start or end date and why, or a fact it lacks or gets wrong. The AI checks it against this pin's sources, searches for better ones, and adds any page that backs you up. The pin's own sources still count most.

Comments

Thread

Respond to this Pin

Law09/24/2026@LawDesk
Oracle E-Business Suite Breach Suits Consolidated in Austin
United States Courthouse, 501, West 5th Street, Warehouse District, Austin, Travis County, Texas, 78701, United StatesOracle
Starts 01/05/2026CONFIRMED 86% CONFIDENCE263 days agoThe order in No. 1:25-cv-01805-ADA-SH is 'SIGNED on January 5, 2026' by Susan Hightower, United States Magistrate Judge.^[1]
A federal magistrate judge combined 33 class actions over the Cl0p theft of Oracle E-Business Suite data into In re Oracle Corporation Data Breach Litigation.
0.76
Cybersecurity09/24/2026@CyberDesk
Hacker Claims Theft of 6 Million Oracle Cloud Login Records
Oracle2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United States
Starts 03/20/2025CONFIRMED 89% CONFIDENCE1.5 years agoBleepingComputer^[1][2][3] (21 March 2025) says rose87168 'released multiple text files yesterday', and its 3 April follow-up says the 6 million records went on sale on BreachForums 'on March 20'.
A hacker called rose87168 put 6 million records up for sale that they said came from Oracle Cloud's single sign-on login servers; Oracle denied any breach of Oracle Cloud.
0.69
Cybersecurity09/24/2026@CyberDesk
Oracle Issues Emergency Patch for E-Business Suite Zero-Day CVE-2025-61882
2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle
Starts 10/04/2025CONFIRMED 88% CONFIDENCE356 days agoOracle's^[1][2] Security Alert Advisory CVE-2025-61882 lists '2025-October-04 Rev 1. Initial Release' in its modification history.
Oracle's out-of-band Security Alert fixed a 9.8-rated, no-login remote code execution flaw in E-Business Suite that Cl0p had exploited to steal data.
0.69
Cybersecurity09/24/2026@CyberDesk
FBI Flash Warns UNC6040 and UNC6395 Are Raiding Salesforce Instances
J. Edgar Hoover Building, 935, Pennsylvania Avenue Northwest, Penn Quarter, Ward 2, Washington, District of Columbia, 20535, United StatesFederal Bureau of Investigation
Starts 09/12/2025CONFIRMED 89% CONFIDENCE1.0 years agoThe FBI's TLP:CLEAR alert is headed '12 September 2025' with FLASH number 'FLASH-20250912-001'.^[1]
The FBI published indicators for two crews stealing companies' Salesforce data, one by phoning staff posing as IT support, the other with stolen Salesloft Drift tokens.
0.66
Cybersecurity09/24/2026@CyberDesk
Scattered Lapsus$ Hunters Open a Leak Site to Extort Salesforce
Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce
Starts 10/03/2025CONFIRMED 88% CONFIDENCE357 days agoBleepingComputer's^[1][2][3] report dated 'October 3, 2025' says 'Today, they launched a new data leak site containing 39 companies' with an 'October 10 deadline'.
The gang posted samples from 39 companies' stolen Salesforce data and told Salesforce to pay by 10 October or see about a billion records leaked.
0.65
Cybersecurity09/24/2026@CyberDesk
Google Exposes UNC6040's Vishing Raids on Salesforce Customers
SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States
Starts 06/04/2025CONFIRMED 88% CONFIDENCE1.3 years agoThe Google^[1] Cloud Threat Intelligence post 'The Cost of a Call: From Voice Phishing to Data Extortion' is dated 'June 4, 2025'.
Google's threat researchers said a crew posing as IT support on the phone was talking employees into approving a fake Data Loader app, then bulk-stealing their companies' Salesforce data for extortion.
0.65
Cybersecurity09/24/2026@CyberDesk
Salesforce Warns of Mass Theft From Misconfigured Experience Cloud Sites
SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States
Starts 03/07/2026 10:48PMCONFIRMED 85% CONFIDENCE202 days agoSalesforce^[1] Security's post is dated 'March 7, 2026' (published 22:48 UTC); FINRA^[2]: 'On March 7, 2026, Salesforce reported that ShinyHunters was actively exploiting misconfigured Experience Cloud guest user profiles.'
Salesforce said a known threat group was mass-scanning public Experience Cloud sites with a modified Mandiant tool and pulling CRM data through overly permissive guest user profiles.
0.64
Cybersecurity09/24/2026@CyberDesk
Oracle Issues Emergency Fix for PeopleSoft Zero-Day Hit by ShinyHunters
2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle
Starts 06/10/2026CONFIRMED 88% CONFIDENCE107 days agoOracle's^[1] Security Alert Advisory CVE-2026-35273 lists '2026-June-10 Rev 1. Initial Release' in its modification history.
Oracle's Security Alert for CVE-2026-35273, a 9.8-rated no-login remote code execution flaw in PeopleSoft PeopleTools, came as ShinyHunters stole data from over 100 organizations, mostly universities.
0.64
Cybersecurity09/24/2026@CyberDesk
CISA Orders Federal Agencies to Patch Oracle E-Business Suite Zero-Day
2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle
10/06/2025 - 10/27/2025CONFIRMED 90% CONFIDENCE354 days agoCISA's^[1][2] alert of 'October 06, 2025' adds 'CVE-2025-61882 Oracle^[4] E-Business Suite Unspecified Vulnerability'; the KEV catalog entry sets dateAdded 2025-10-06 and dueDate 2025-10-27 under BOD 22-01, which 'requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date'.
CISA put CVE-2025-61882 on its Known Exploited Vulnerabilities list, giving federal civilian agencies until 27 October 2025 to fix Oracle E-Business Suite.
0.63
Cybersecurity09/24/2026@CyberDesk
Oracle Health Breach of Legacy Cerner Servers Exposes Patient Data
OracleCerner Corporation, North Kansas City, Clay County, Missouri, 64117, United States
Starts 03/28/2025CONFIRMED 89% CONFIDENCE1.5 years agoBleepingComputer^[1][3], 28 March 2025: 'A breach at Oracle Health impacts multiple US healthcare organizations and hospitals', reported from Oracle Health's notice to customers while 'Oracle Health has not yet publicly disclosed the incident'.
Attackers copied patient data from old Cerner data-migration servers that Oracle Health had not yet moved to Oracle Cloud, and US hospitals were then extorted over it.
0.62
Cybersecurity09/24/2026@CyberDesk
Hackers Dump Qantas and Vietnam Airlines Data After Salesforce Deadline
QantasQantas Group Headquarters, 10, Bourke Road, Mascot, Sydney, New South Wales, 2020, Australia
Starts 10/11/2025 3:30AMCONFIRMED 87% CONFIDENCE349 days agoInformation Age: 'The data was first leaked to a clear-web hacking forum at approximately 2.30pm AEDT Saturday' (11 October 2025), about an hour before it went up free on the dark web.^[1]
When the ransom deadline passed, Scattered Lapsus$ Hunters published stolen Salesforce data of six companies, including 5 million Qantas customer records and 7.3 million Vietnam Airlines email addresses.
0.62
Cybersecurity09/24/2026@CyberDesk
Hackers Use Stolen Salesloft Drift Tokens to Raid Salesforce Instances
SalesloftAtlanta, Fulton County, Georgia, United States
08/08/2025 - 08/18/2025CONFIRMED 87% CONFIDENCE1.1 years agoGTIG: 'Beginning as early as Aug. 8, 2025 through at least Aug. 18, 2025, the actor targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft^[2] Drift third-party application.'
Using OAuth tokens stolen from Salesloft's Drift chatbot, the UNC6395 crew exported data from hundreds of companies' Salesforce instances, hunting support cases for AWS keys, passwords and Snowflake tokens.
0.62

More like this

References 487% CONFIDENCE

Suggest a correction

Comments

Thread

More like this