Four Companies Have Yet to Comment on Alleged Oracle EBS Breach Impact
Summary
Cl0p listed Broadcom, Bechtel, Estée Lauder and Abbott as alleged Oracle EBS campaign victims; none had publicly commented. SecurityWeek's metadata and file-tree review found some leaked files originated from Oracle EBS, but it did not download the data.
Key points
- Cl0p took credit for a campaign allegedly exploiting Oracle EBS zero-day vulnerabilities to access organizational data for extortion.
- The cybersecurity community believes the operation may have involved a cluster of actors, particularly FIN11; this attribution is not confirmed.
- Cl0p listed more than 100 alleged victims on its leak site. The article says most large organizations targeted publicly confirmed a data breach, while some described the impact as limited.
- Broadcom, Bechtel, Estée Lauder and Abbott were listed on or around November 20, 2025, and had not publicly confirmed or denied being affected or said they were investigating; they did not respond to SecurityWeek's requests for comment.
- SecurityWeek's metadata and file-tree analysis found that files allegedly obtained from some listed companies originated from an Oracle EBS environment; it did not download the leaked data.
- The Broadcom torrent pointed to more than 2 TB of archives and the Estée Lauder torrent to 870 GB. Bechtel and Abbott torrents were available, but SecurityWeek could not retrieve data from them for analysis.
Article Details
- Victim Organization
- Broadcom, Bechtel, Estée Lauder Companies, and Abbott Laboratories were listed on the Cl0p website as alleged victims; none had publicly confirmed or denied impact.
- Incident Type
- Oracle E-Business Suite zero-day exploitation and alleged data theft for extortion.
- Data Types Exposed
- Files allegedly stolen from Oracle E-Business Suite environments; specific contents were not verified.
- Affected Data Size
- Cl0p published more than 2 TB of archives allegedly associated with Broadcom and a torrent pointing to 870 GB of archive files allegedly associated with Estée Lauder Companies. No data was retrieved for analysis from the Bechtel or Abbott torrents.
- Operational Impact
- No operational impact was confirmed for the four named companies; they had not publicly commented on the allegations.
- Ransom Or Extortion
- Cl0p claimed credit for the campaign and allegedly used stolen data and leak-site torrents for extortion. The article says torrents for most victims indicate they refused to pay, but does not establish payment status for the four named companies.
- Claim Status
- claimed
Threat Actors
Cl0pThe article identifies Cl0p as a ransomware and extortion group that claimed credit for the Oracle EBS campaign and listed alleged victims and data on its leak website.FIN11The article says the cybersecurity community believes the campaign may have been driven by a threat-actor cluster, most notably FIN11; this attribution is uncertain.
Vendors
Products
Industries
ConstructionThis includes semiconductor and infrastructure software company Broadcom, engineering and construction firm Bechtel, cosmetics group Estée Lauder Companies, and medical devices and healthcare solutions provider Abbottconsumer goodssuch as technology, telecommunications, software, heavy industry, manufacturing, engineering, retail, consumer goods, energy, utilities, media, finance, and entertainment.Cosmeticssemiconductor and infrastructure software company Broadcom, engineering and construction firm Bechtel, cosmetics group Estée Lauder Companies, and medical devices and healthcare solutions provider Abbott Laboratories.Energytelecommunications, software, heavy industry, manufacturing, engineering, retail, consumer goods, energy, utilities, media, finance, and entertainment.Engineeringin sectors such as technology, telecommunications, software, heavy industry, manufacturing, engineering, retail, consumer goods, energy, utilities, media, finance, and entertainment.Entertainmentindustry, manufacturing, engineering, retail, consumer goods, energy, utilities, media, finance, and entertainment.financesoftware, heavy industry, manufacturing, engineering, retail, consumer goods, energy, utilities, media, finance, and entertainment.Healthcareand construction firm Bechtel, cosmetics group Estée Lauder Companies, and medical devices and healthcare solutions provider Abbott Laboratories.Heavy Industryleak website, including organizations in sectors such as technology, telecommunications, software, heavy industry, manufacturing, engineering, retail, consumer goods, energy, utilities, media, finance, andManufacturingincluding organizations in sectors such as technology, telecommunications, software, heavy industry, manufacturing, engineering, retail, consumer goods, energy, utilities, media, finance, and entertainment.Mediasoftware, heavy industry, manufacturing, engineering, retail, consumer goods, energy, utilities, media, finance, and entertainment.medical devicesBroadcom, engineering and construction firm Bechtel, cosmetics group Estée Lauder Companies, and medical devices and healthcare solutions provider Abbott Laboratories.Retailin sectors such as technology, telecommunications, software, heavy industry, manufacturing, engineering, retail, consumer goods, energy, utilities, media, finance, and entertainment.SoftwareThe Cl0p ransomware and extortion group has taken credit for the EBS hacking campaign, which involved exploiting zero-day vulnerabilities to access data stored by organizations in Oracle’s enterprise management software.Technologyvictims of the Oracle EBS campaign on the Cl0p leak website, including organizations in sectors such as technology, telecommunications, software, heavy industry, manufacturing, engineering, retail, consumer goods,TelecommunicationsEBS campaign on the Cl0p leak website, including organizations in sectors such as technology, telecommunications, software, heavy industry, manufacturing, engineering, retail, consumer goods, energy, utilities,Utilitiessoftware, heavy industry, manufacturing, engineering, retail, consumer goods, energy, utilities, media, finance, and entertainment.