Washington Post confirms data breach linked to Cl0p’s Oracle E-Business Suite suite attack

The Washington Post has confirmed that it was targeted in a ransomware attack carried out by the Cl0p cybercrime group as part of a broader exploitation campaign against Oracle’s E-Business Suite (EBS) software.

In a statement issued Thursday, the Washington, D.C.-based newspaper said it was among hundreds of organizations impacted by the ongoing breach of the Oracle E-Business Suite platform, a widely used enterprise software system that manages business functions such as finance, logistics, and customer relations.

The Washington Post, owned by Amazon founder Jeff Bezos, appeared this week on Cl0p’s dark web leak site, where the gang highlighted the newspaper’s domain name in bright yellow and posted a warning message that read, “WASHINGTONPOST.COM – PAGE CREATED, WARNING.” The listing signaled the group’s latest extortion attempt, which typically threatens to publish stolen data unless victims pay a ransom.

Cl0p’s campaign stems from a critical zero-day vulnerability in Oracle’s EBS software that the group began exploiting over the summer. The flaw, which allowed unauthorized access to sensitive systems, went unpatched for weeks as Oracle rushed to address the issue. An initial fix released in early October proved ineffective, forcing the company to issue a second emergency update on October 11.

The Post has not disclosed the extent of the breach, what specific systems were affected, or whether any sensitive data was exfiltrated. The incident underscores the widespread impact of Cl0p’s latest attack wave, which has compromised a growing list of high-profile victims, including Harvard University, DXC Technology, Chicago Public Schools, and Envoy Air, the largest regional carrier for American Airlines.

Cl0p, a ransomware group believed to operate from Russia, has been active since at least 2019 and is responsible for some of the largest cyber extortion campaigns to date. Its previous exploits targeting MOVEit, Fortra GoAnywhere, and Cleo file transfer systems collectively affected thousands of organizations and tens of millions of individuals worldwide.