Over 100 firms likely hit in Oracle-linked hacking campaign, says Google

Google

According to Reuters report, Google said on Thursday that over 100 companies were likely impacted by an extensive hacking campaign targeting Oracle’s suite of business products. The company’s early assessment suggests the attack, linked to the CL0P ransomware group, could have begun as early as three months ago and led to the theft of massive amounts of customer data.

Details of the breach

The Reuters report noted that Google described the operation as one involving “mass amounts of customer data” stolen through Oracle’s E-Business Suite — a platform used by enterprises to manage customers, suppliers, logistics, and other business operations. In a statement cited by Reuters, Google said the attackers likely invested significant resources into pre-attack research before breaching the systems.

Google, which operates a dedicated cybersecurity division, said in a blog post that CL0P has a history of exploiting vulnerabilities in third-party software and service providers. The report quoted Google analyst Austin Larsen, who said, “We are aware of dozens of victims, but we expect there are many more. Based on the scale of previous CL0P campaigns, it is likely there are over a hundred.”

Response from Oracle and others

Oracle did not immediately respond to Reuters’ request for comment, though it had earlier confirmed that extortion activity was directed at its clients. The hacker group CL0P also did not reply to Reuters’ email but previously claimed Oracle had “bugged up their core product.”

The attack underscores growing risks to enterprise software providers and their customers amid increasing global cyber threats. Google said it is working with affected organizations to assess the scale of the breach and help secure compromised systems. Reuters noted that this campaign could have wide-ranging consequences, given Oracle’s role in handling sensitive business and operational data for companies worldwide.