Harvard Confirmed as Victim in Oracle E-Business Suite Cyberattack

Harvard University has become the first confirmed victim of the ongoing cybercrime campaign targeting Oracle’s E-Business Suite (EBS) customers. The attack, attributed to actors associated with the Cl0p ransomware group, highlights the growing threat to organizations relying on enterprise resource planning (ERP) systems for critical administrative and financial operations.

Discovery and Confirmation

The breach came to light when Harvard appeared on the Cl0p ransomware leak site on October 12, 2025. Initially, the listing included only the university’s name, but the attackers have since published a link allegedly containing 1.3 terabytes of archived Harvard data.

In a public statement, Harvard confirmed its involvement in the Oracle EBS breach campaign. The university stated that the compromise was limited to a small administrative unit and affected a restricted number of associated parties. The institution emphasized that the vulnerability exploited in the attack has been patched and that there is no evidence of further system compromise.

Scope of the Oracle EBS Campaign

According to Google’s Threat Intelligence Group (GTIG) and Mandiant, the same cybercriminal campaign has impacted dozens of organizations globally, spanning multiple sectors.

Oracle’s E-Business Suite is a widely used enterprise platform that manages key functions such as finance, human resources, supply chain, and customer data. Consequently, data stolen from compromised systems may vary in sensitivity—from employee and supplier information to financial and inventory records.

The attackers have been sending extortion emails to company executives, demanding payment in exchange for preventing data publication. These communications invoke the name of Cl0p ransomware, leveraging the group’s notoriety for similar high-profile breaches involving MOVEit, Fortra GoAnywhere, Cleo, and Accellion file transfer products.

Attribution and Technical Details

While the current Oracle EBS campaign has not been definitively attributed to a specific threat actor, GTIG and Mandiant observed strong connections to FIN11, a financially motivated cybercrime group historically linked to Cl0p operations.

Researchers from CrowdStrike reported that exploitation activity began around August 9, 2025, although Google’s telemetry suggests that the first signs of intrusion may have appeared as early as July 10. The campaign reportedly involves both known and zero-day vulnerabilities in Oracle EBS, paired with custom malware designed to steal data and maintain persistence within enterprise networks.

Conclusion

The confirmation of Harvard’s involvement underscores the widespread reach and sophistication of the ongoing Oracle EBS exploitation campaign. Although Harvard reports minimal impact, the incident serves as a stark reminder of the risks associated with enterprise software vulnerabilities and the importance of rapid patch management and proactive threat monitoring in protecting sensitive institutional data.