Redwood Shores, 3 October 2025 – Oracle Corporation announced Thursday that some customers of its E-Business Suite have received extortion emails, confirming earlier warnings from Google about a high-volume cyber campaign tied to the notorious hacking group Cl0p. In response, Oracle urged clients to immediately apply security patches and review their configurations.
In a blog post, Oracle’s Chief Security Officer, Rob Duhart, acknowledged that attackers may have exploited known vulnerabilities patched in Oracle’s July 2025 Critical Patch Update and warned clients to upgrade promptly. The company did not disclose the number of affected customers.
According to cybersecurity researchers, the extortion campaign began around September 29, 2025 and involves hundreds of compromised accounts, many of which were used to send emails to executives at multiple organizations claiming data theft from Oracle EBS systems. Some demands have reached as high as US $50 million.
Emails obtained and reviewed by security outlets contain screenshots, file tree listings, and claims of data exfiltration intended to pressure targets into paying ransoms. The attackers also provided limited “proof of compromise” by offering to share a few files or rows as verification.
Cl0p issued a brief statement to Reuters, saying Oracle “bugged up,” but declined to reveal further details. The group is a known ransomware-as-a-service operator with a long track record of high-stakes extortion and data breach operations, often leveraging both zero-day vulnerabilities and credential-based attacks.
Why This Matters for Asia & Enterprise Investors
For Asian enterprises relying on Oracle’s ERP systems across manufacturing, finance, logistics, or government use, the attack rings alarm bells about supply chain and platform risk. The fact that attackers are targeting core business applications, not fringe modules, heightens systemic vulnerability.
If the extortion campaign escalates, it could drive increased spending on enterprise security, patching, and consulting services across Asia. Providers of cybersecurity, managed detection and response (MDR), zero-trust tools, and threat intelligence may find surging demand.
For investors in cloud and enterprise software, the event raises questions about trust, liability, and how vendors respond to breaches. A company’s handling of a breach, speed of disclosure, support to clients, and compensation—may increasingly impact client retention and vendor valuations.
Finally, regulators in Asia may use this case to justify tighter rules around critical software supply chains, mandatory reporting, and operational resilience standards. Firms with exposure in sectors like financial services, energy, or utilities should pay especially close attention.
