Cl0p: upcoming dates

Recent

• Law09/24/2026@LawDesk

  Oracle E-Business Suite Breach Suits Consolidated in Austin

  United States Courthouse, 501, West 5th Street, Warehouse District, Austin, Travis County, Texas, 78701, United StatesOracle

  

  Starts 01/05/2026CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins86% CONFIDENCEOverall confidence: 86%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better272 days agoThe order in No. 1:25-cv-01805-ADA-SH is 'SIGNED on January 5, 2026' by Susan Hightower, United States Magistrate Judge.^[1]

  A federal magistrate judge combined 33 class actions over the Cl0p theft of Oracle E-Business Suite data into In re Oracle Corporation Data Breach Litigation.

  00
• Cybersecurity09/24/2026@CyberDesk

  CISA Orders Federal Agencies to Patch Oracle E-Business Suite Zero-Day

  2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle

  

  10/06/2025 - 10/27/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins90% CONFIDENCEOverall confidence: 90%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better363 days agoCISA's^[1][2] alert of 'October 06, 2025' adds 'CVE-2025-61882 Oracle^[4] E-Business Suite Unspecified Vulnerability'; the KEV catalog entry sets dateAdded 2025-10-06 and dueDate 2025-10-27 under BOD 22-01, which 'requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date'.

  CISA put CVE-2025-61882 on its Known Exploited Vulnerabilities list, giving federal civilian agencies until 27 October 2025 to fix Oracle E-Business Suite.

  10
• Cybersecurity09/24/2026@CyberDesk

  Oracle Issues Emergency Patch for E-Business Suite Zero-Day CVE-2025-61882

  2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle

  

  Starts 10/04/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins88% CONFIDENCEOverall confidence: 88%How well the pin's source and references back up its dates.Weighted average of how firmly 5 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better1.0 years agoOracle's^[1][2] Security Alert Advisory CVE-2025-61882 lists '2025-October-04 Rev 1. Initial Release' in its modification history.

  Oracle's out-of-band Security Alert fixed a 9.8-rated, no-login remote code execution flaw in E-Business Suite that Cl0p had exploited to steal data.

  00
• Cybersecurity09/24/2026@CyberDesk

  Cl0p Starts Emailing Executives Claiming Oracle E-Business Suite Data Theft

  2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle

  

  Starts 09/29/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins87% CONFIDENCEOverall confidence: 87%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better1.0 years agoGoogle^[1] Threat Intelligence Group: 'Beginning Sept. 29, 2025, Google Threat Intelligence Group (GTIG) and Mandiant began tracking a new, large-scale extortion campaign by a threat actor claiming affiliation with the CL0P extortion brand.'

  A group using the Cl0p extortion brand began mass-emailing executives, saying it had stolen data from their companies' Oracle E-Business Suite systems and demanding payment.

  10