Dozens of Firms Hit by Major Oracle Data Breach

Security experts at Google have found a large hacking campaign. The attackers are targeting corporate executives with extortion emails. So far, data from dozens of big companies has been stolen. Google says this is one of the biggest cyberattacks seen this year.

How the Hack Started

The hackers belong to the Clop extortion gang, a group based in Russia. They broke into systems using flaws in Oracle’s E-Business Suite. This software helps companies manage their daily operations—such as handling customer data, HR files, and business records.

Google said the attacks began around July 10. That’s months before most victims noticed something was wrong. The hackers exploited a zero-day bug, a previously unknown flaw in Oracle.

This bug lets hackers enter systems without usernames or passwords. Once inside, they copied huge amounts of private data. Then, they sent threatening emails to top executives. They demanded money or threatened to leak the stolen data.

Oracle’s Reaction

Oracle first said the problem was fixed back in July. But new evidence shows the attacks are still happening. The hackers continue to use the same bug to steal more data.

Oracle confirmed this week that the threat is not over. The company warned all customers to update their systems now. They also said the bug could be used over the internet—no login details needed — making it even more dangerous.

Who Are the Clop Hackers?

Clop has been active for years. They have attacked major tech systems worldwide. Instead of locking files like typical ransomware, they steal data and demand payment for silence.

They’ve hit tools like MOVEit, GoAnywhere, and Cleo Software. These programs move sensitive company files online. Clop finds hidden weaknesses, takes the data, and asks for ransom.

Experts say this new attack on Oracle shows a shift. Hackers now aim for enterprise-level systems. A single breach can expose millions of records at once.

Google’s Warning

Google shared details in a new blog post. It includes email addresses, IPs, and clues that companies can check. Google urged IT teams to look for warning signs — like strange login attempts or suspicious extortion emails.

The company warned that once hackers get in, they can move fast, copy data, and even delete backups. So time matters. Organizations need to act quickly.

Here’s what experts suggest:

Install all Oracle security updates immediately.
Watch for unusual data transfers or system errors.
Teach staff how to spot phishing or extortion messages.
Use multi-layered security systems like firewalls and monitoring tools.

What Happens Next

Oracle released an emergency patch for the issue. They’re working with Google and U.S. law enforcement. The company said it’s reviewing all systems to make sure this kind of attack doesn’t happen again.

But this incident shows a bigger problem. Hackers are finding new ways to move faster than security teams. As soon as one weakness is fixed, another appears.

Experts say companies must be more proactive. That means constant updates, better monitoring, and teaching employees how to protect sensitive data.

A Global Cybersecurity Wake-Up Call

This attack is part of a growing pattern. Hackers are targeting large systems that hold massive data. They use smarter tools, often powered by AI, to find and attack new software flaws faster than ever.

It’s a reminder for all companies, big or small, that data protection is now a daily job.
Cybersecurity is no longer an option. It’s a must.

Governments and tech firms must work together. They need stronger systems and faster response plans. Once data is stolen, it’s often impossible to get it back. Prevention is the only real defense.

FAQs

1. Who is behind the attacks?

The attacks are linked to the Clop extortion group, based in Russia. They are known for stealing data from large companies and demanding a ransom.

2. What is a zero-day bug?

It’s a security hole unknown to the software maker. Hackers exploit it before a fix is made, leaving no time to prepare.

3. How can companies protect themselves?

They should update all Oracle software, watch for strange system activity, and train staff to recognize email threats.

4. What kind of data was stolen?

The hackers stole business files, HR data, and customer records. Some information from corporate executives may also be at risk.

5. Is the threat still active?

Yes. Google and Oracle both say the hackers are still exploiting the system. All users must install updates and monitor their networks immediately.

Dozens of Organizations Face Data Theft in Oracle-Linked Security Breach