Washington Post Falls Victim to Oracle-Linked Data Breach

Google researchers said that 100 companies were affected by the hacking campaign targeting Oracle's business software, and that 'mass amounts of customer data' were stolen in the operation. Harvard University and American Airlines-owned carrier Envoy were also impacted.

The Washington Post has confirmed it fell victim to a large-scale cybercrime campaign that targeted Oracle's business applications, joining Harvard University and American Airlines-owned carrier Envoy, which announced similar breaches last month.

The news, first reported by Reuters, comes after Google said in October that it believes around 100 companies were affected by the hacking campaign, and that “large amounts of customer data” were stolen in an operation it said may have begun in July. Google said that it involved hackers taking advantage of a vulnerability in Oracle's E-Business Suite platform, a widely adopted piece of ERP software which businesses use to manage their operations.

Oracle said in a security notice that several of its customers have faced extortion attempts in relation to the attack. The Post didn’t provide much detail regarding the nature of the recent breach, such as what, if any, data had been lost. According to Google's researchers, Oracle patched the vulnerability in early October and directed all the product’s users to update their software immediately.

The true perpetrator of the attack is still unknown, but a cybercrime group known as Cl0p has claimed it was responsible for the breach on its website, claiming that the newspaper “doesn’t care about its security.” The Russian-speaking Cl0p, which was first observed in 2020, specializes in ransomware attacks.

More data breaches linked to the incident could still come to light. Certis Foster, senior threat hunter lead at Deepwatch, told SC Media that “Many haven't been disclosed yet because Cl0p tends to wait a few weeks before posting data to put pressure on ransom payments.”

Gaining access to a company's ERP systems can potentially give hackers access to a wide range of their data. Heath Renfrow, co-founder and chief information security officer at Fenix24, said that when hackers get access to ERP systems “they gain privileged access to financial data, HR records, supplier systems, and core operational workflows.”

Source