Oracle E-Business Hack Continues to Generate Ransom Demands

A rising number of companies using Oracle’s E-Business Suite are facing ransom demands following a cyberattack that may have begun as early as July 2025. The breach, first publicly disclosed by Oracle in October, has continued to impact organizations worldwide as hackers exploit stolen sensitive data for extortion.

Timeline and Discovery

Oracle revealed in October 2025 that certain security vulnerabilities in its widely used business software had been exploited, allowing unauthorized access to customer data. Cybersecurity experts now believe the initial breach may have occurred months earlier, in July, suggesting the attackers had a prolonged period to extract sensitive information.

‍

The E-Business Suite is deployed by thousands of enterprises globally to manage financials, supply chain, procurement, and human resources operations. Compromises in the software therefore carry significant operational and financial risk for affected organizations.

Ransom Demands Escalate

Since the breach was disclosed, the attackers have begun contacting affected companies with ransom demands reportedly totaling millions of dollars. The extortion campaigns involve threats to release or sell sensitive corporate information unless payment is made.

‍

Cybersecurity specialists warn that these ransom operations could continue for months, given the volume of data potentially exposed and the number of organizations that may remain unaware of whether they were compromised.

Security Implications

Experts say the incident highlights the persistent risks in enterprise software systems, particularly widely deployed platforms like Oracle E-Business Suite. Organizations that delay patching or fail to monitor for unusual activity may be especially vulnerable to prolonged intrusion campaigns and targeted extortion.

‍

Oracle has advised customers to apply all relevant security updates and review internal controls for suspicious activity. The company has also emphasized its cooperation with law enforcement and cybersecurity authorities investigating the incident.

Broader Concerns

The attack comes amid a spate of high-profile breaches in 2025 and 2026, including incidents affecting healthcare, finance, and cloud service providers. Analysts note that attackers are increasingly targeting enterprise software because the data is often highly sensitive and can yield significant ransom payouts.

‍

Industry observers say that organizations must implement layered security, rapid incident response plans, and employee awareness training to mitigate risks associated with software vulnerabilities.