In partnership with
CYBER SYRUP
Delivering the sweetest insights on cybersecurity.
Realtime User Onboarding, Zero Engineering
Quarterzip delivers realtime, AI-led onboarding for every user with zero engineering effort.
✨ Dynamic Voice guides users in the moment
✨ Picture-in-Picture stay visible across your site and others
✨ Guardrails keep things accurate with smooth handoffs if needed
No code. No engineering. Just onboarding that adapts as you grow.
Dartmouth College Confirms Data Breach Linked to Oracle E-Business Suite Zero-Day Attack
Dartmouth College has confirmed a data breach involving unauthorized access to its Oracle E-Business Suite (EBS) instance during the widespread zero-day exploitation campaign attributed to the Cl0p ransomware group. The attack occurred between August 9–12 and resulted in the exfiltration of personal and financial information, including Social Security numbers. More than 32,000 individuals across multiple states have already been identified as affected, with the full total still unknown.
Context
Oracle E-Business Suite is used by universities, corporations, and government entities to manage enterprise operations such as finance, HR, supply chain, and procurement. In mid-2024, attackers began exploiting a previously unknown vulnerability to compromise EBS environments across hundreds of organizations globally.
Higher-education institutions have been disproportionately affected due to:
Large, distributed administrative systems
Sensitive financial and student data stores
Slower patching cycles for complex enterprise systems
Heavy reliance on legacy EBS modules
Dartmouth joins a growing list of academic institutions impacted by this coordinated attack campaign.
What Happened
Dartmouth reported that:
Its Oracle EBS instance was compromised during the zero-day exploitation window (August 9–12).
The university discovered in late October that files containing personal and financial information were exfiltrated.
Stolen data included Social Security numbers and other sensitive identifiers.
Notifications were filed with state authorities:
~1,500 Maine residents affected
~31,000 New Hampshire residents affected
The full national and international impact has not yet been disclosed.
The Cl0p ransomware group has publicly claimed responsibility via its leak site.
Technical Breakdown
While Dartmouth has not detailed the specific exploit used, the broader Oracle EBS campaign involved key elements:
Zero-day vulnerability enabling unauthorized access to EBS file systems
Automated data harvesting across financial and HR modules
Bulk file exfiltration prior to detection
No encryption deployed in many cases, suggesting a data-theft-first extortion model
Cl0p later released 226 GB of archives allegedly taken from Dartmouth systems. Metadata analysis strongly indicates that the leaked files originated from Dartmouth’s EBS environment.
Other academic institutions listed as victims include:
Harvard University (confirmed)
Southern Illinois University (previously hit in MOVEit)
Tulane University
Impact Analysis
The reported data includes highly sensitive information such as:
Social Security numbers
Financial and tax-related documents
University administrative records
Personal data tied to students, faculty, and staff
Affected populations may span:
Students and former students
Faculty and staff
Contractors
Alumni
Applicants
Administrative personnel
Such data enables a range of downstream threats:
Identity theft
Financial fraud
Long-term impersonation attacks
Targeted phishing leveraging university-specific details
Because Cl0p has already leaked Dartmouth’s stolen archives, individuals face an increased risk of misuse.
Why It Matters
The attack highlights several systemic issues:
Higher-education institutions remain prime targets due to large datasets and complex IT ecosystems.
Oracle EBS environments are mission-critical but often difficult to patch quickly.
The Cl0p group continues to pivot toward zero-day supply-chain exploitation rather than traditional ransomware encryption.
Data-theft extortion campaigns create long-lasting exposure even after remediation.
For universities managing large populations across multiple states, breach notifications and recovery processes can stretch months or years.
Expert Commentary
Security analysts note that:
Zero-day exploitation of ERP systems is becoming increasingly common.
Data-theft-only ransomware operations reflect an evolution in attacker strategy.
Universities must treat enterprise systems (ERP, EBS, HRIS) as high-risk assets requiring specialized monitoring and rapid patching.
Cl0p, previously responsible for the MOVEit campaign, has demonstrated sustained operational capability across multiple sectors.
Key Takeaways
Dartmouth’s Oracle EBS system was compromised through a zero-day exploited by Cl0p.
Sensitive data—including Social Security numbers—was exfiltrated.
Over 32,000 individuals across multiple states have been notified so far.
Cl0p leaked 226 GB of Dartmouth data on its extortion site.
Higher-education institutions continue to face escalating supply-chain risks.
ERP and enterprise financial systems are high-value targets requiring enhanced security oversight.