Cl0p Oracle EBS Breach: Shell, Philips Named Victims

The extortion crew Cl0p has escalated one of the year’s largest enterprise-software breach campaigns, publishing the names of some of the biggest companies in the world on its leak site. In posts that began circulating around August 13, 2026, the group claimed it stole data from close to 50 organizations by exploiting a flaw in Oracle’s E-Business Suite (EBS), and it named marquee victims including the energy giant Shell, the Dutch health-technology firm Philips, industrial conglomerate GE, and the payments company Fiserv.

Several of the named companies have now responded. On August 22, 2026, Shell said it is “aware of a potential incident” and is investigating — a statement that neither confirms nor rules out a breach. Philips described the event as an attempted cyberattack on a server that was “brought under control,” with no impact on customer environments. The victim count and the volume of stolen data come from Cl0p itself and have not been independently verified.

What Cl0p is claiming

According to the group’s own postings, the haul is substantial. Cl0p says it took roughly 89GB of data from Shell, including technical drawings, facility images, and project plans, and about 13.5GB from Philips, described as mostly diagrams and blueprints. The group has framed the disclosures as pressure tactics: publish the names, tease the volume, and give victims a window to pay before the full datasets go public.

That is the signature of Cl0p’s operating model — “pay-or-leak” extortion, sometimes called double extortion. Rather than encrypting a victim’s files and demanding a ransom to unlock them, the group exfiltrates sensitive data quietly and then threatens to publish it. The leverage is the threat of exposure, not the disruption of operations, and it does not require deploying a single piece of encrypting malware to be effective. It is the same playbook the group has run against widely deployed enterprise software before, most recently in the PTC Windchill campaign tracked as CVE-2026-12569.

The named companies’ cautious responses reflect a genuine uncertainty. When a criminal group claims a breach, the claim itself is a form of pressure, and the actual exposure — which systems were reached, what data left the building, whether the listed volumes are real — often takes weeks of forensic work to establish. “Aware of a potential incident” is the language of a company that has not yet confirmed the scope, not necessarily one that has ruled it out.

The vulnerability at the center

Security researchers have linked the campaign to CVE-2025-61882, a critical flaw in Oracle E-Business Suite. Oracle confirmed the vulnerability on October 5, 2025, and issued an emergency patch, but by then the bug had already been exploited in the wild. Investigators at Google’s Threat Intelligence Group and Mandiant traced the earliest evidence of exploitation to August 9, 2025 — weeks before any fix existed, making it a live zero-day during that window.

The flaw is remotely exploitable without authentication and can lead to remote code execution. That combination — no login required, reachable over the network, full code execution on the target — is the worst-case profile for a piece of software that sits at the center of a company’s finance, procurement, HR, and supply-chain operations. Oracle E-Business Suite is precisely that kind of system: a sprawling enterprise resource-planning platform that large organizations run to manage the core of their back-office operations.

The technical shape of the incident mirrors a pattern the industry keeps encountering. A single unauthenticated bug in a ubiquitous enterprise platform functions as a skeleton key: an attacker does not need to know anything specific about a target beyond the fact that it runs a vulnerable, internet-facing instance. Automated scanning finds the exposed deployments, and the same exploit works against all of them. That is how one flaw becomes a campaign spanning dozens of unrelated companies simultaneously, an approach nearly identical to the Oracle PeopleSoft mass breach earlier this year, in which a different extortion group used a single unauthenticated bug to compromise more than 100 organizations.

A campaign that started in 2025

The August 2026 disclosures are not the beginning of this story but an escalation of it. The campaign traces back to late September 2025, when Google and Mandiant began tracking a high-volume wave of extortion emails sent to executives at numerous organizations, claiming the theft of sensitive data from their Oracle EBS environments. The activity was attributed to a threat actor claiming affiliation with the Cl0p brand, tied by researchers to the financially motivated group commonly tracked as FIN11.

By November 2025, Cl0p had listed roughly 29 named victims on its data-leak site, working through its list methodically. The August 2026 postings — with the addition of Shell, Philips, GE, Fiserv, and others, pushing the claimed total toward 50 — represent the group continuing to squeeze the same campaign nearly a year after the initial exploitation. This slow-burn cadence is deliberate: staggering disclosures keeps the campaign in the news, maintains pressure on victims still negotiating, and gives the group repeated opportunities to extract payment from organizations that hoped they had escaped notice.

The pattern also underscores how long the tail of a single vulnerability can be. Oracle patched CVE-2025-61882 in October 2025, but a patch closes the door only against future intrusions; it does nothing about data already stolen or intruders who established access before the fix landed. Any EBS instance that was internet-facing during the exploitation window should be treated as potentially compromised, not merely vulnerable.

Who is exposed

The named victims span industries that share one trait: they run large, complex ERP deployments. Shell and GE are industrial giants with sprawling operations; Philips manages sensitive product and manufacturing data; Fiserv sits in the payments infrastructure that moves money for banks and merchants. The value of the stolen data varies by target — technical drawings and facility plans for an energy company, product blueprints for a manufacturer, potentially regulated financial data for a payments firm — but the common thread is that ERP systems concentrate an organization’s most operationally sensitive information in one place.

That concentration is exactly what makes enterprise platforms such attractive targets. The same qualities that make EBS valuable to a business — it centralizes finance, HR, supply chain, and procurement — make it catastrophic when breached. Oracle’s exposure to this class of incident has drawn broader scrutiny of the company’s security posture and of the enterprise-software model generally, a theme that has surfaced even in investor commentary questioning Oracle’s trajectory.

For defenders running Oracle EBS, the immediate action is unambiguous: confirm the October 2025 patch for CVE-2025-61882 is applied, and treat any instance that was reachable from the internet during the exploitation window as a candidate for compromise. That means hunting for signs of intrusion — anomalous requests, unexpected process execution, new accounts, outbound data transfers — rather than merely confirming that a patch is now in place. Restricting internet exposure of ERP administrative interfaces, rotating credentials that a compromised server could have reached, and preparing breach-notification processes are the standard follow-ons.

What it means

The Cl0p EBS campaign is a clean illustration of a lesson the security industry keeps relearning: the most damaging vulnerabilities are rarely in exotic software. They live in the boring, ubiquitous platforms that quietly run finance, HR, and supply chains for thousands of organizations. A single unauthenticated code-execution bug in Oracle E-Business Suite turned a standard enterprise system into a mass-compromise engine, and the criminal economics of that are irresistible: find one flaw in software that hundreds of companies run, and the marginal cost of each additional victim approaches zero.

Who loses. The named companies face months of forensic investigation, breach notification, regulatory questions, and reputational damage — even before accounting for whatever the stolen data enables downstream. Any organization still running an unpatched or under-monitored EBS instance is exposed to the broader criminal ecosystem now that the exploit is well-documented, not just to Cl0p.

Who is validated. Security teams that segment administrative endpoints, keep external attack surface minimal, and treat vendor emergency patches as genuine emergencies came through campaigns like this far better than those that left ERP systems reachable from the open internet. The incident is another argument for defense-in-depth: patching speed matters, but so does ensuring a single exploited service cannot reach everything else.

What to watch next. First, whether the named companies confirm the scope of what was taken — Shell’s and Philips’s careful statements leave the actual exposure an open question. Second, further leaks, as Cl0p works through its claimed 50-plus victims and pressures those still negotiating. Third, regulatory and legal fallout, particularly for the payments and health-technology firms whose data carries the heaviest compliance obligations. The technical hole was closed in October 2025; the human, legal, and reputational aftermath of a zero-day that spanned nearly a year is still unfolding.