Harvard University is investigating a data breach after the Clop ransomware gang listed the school on its data leak site, saying the alleged breach was likely caused by a recently disclosed zero-day vulnerability in Oracle's E-Business Suite servers. "Harvard is aware of reports that data associated with the University has been obtained as a result of a zero-day vulnerability in the Oracle E-Business Suite system. This issue has impacted many Oracle E-Business Suite customers and is not specific to Harvard," a Harvard University Information Technology spokesperson told BleepingComputer. "While the investigation is ongoing, we believe that this incident impacts a limited number of parties associated with a small administrative unit." "Upon receiving it from Oracle, we applied a patch to remediate the vulnerability. We are continuing to monitor and have no evidence of compromise to other University systems." This statement comes after the Clop extortion gang added Harvard to its data leak extortion site, stating that it would soon publicly release the University's data. Earlier this month, Mandiant and Google began tracking a new extortion campaign where numerous companies began receiving emails stating sensitive data was stolen from their Oracle E-Business Suite systems. These emails came from the Clop ransomware operation, which warned that the stolen data would be leaked if a ransom demand was not paid. While Clop would not share details about the attack, they confirmed to ...
Harvard investigating breach linked to Oracle zero-day exploit
Affected Software
Frequently Asked Questions
What has Harvard confirmed about the reported breach?
Harvard said it is aware of reports that University-associated data was obtained through a zero-day vulnerability in Oracle E-Business Suite. Its investigation is ongoing, and it believes the incident affects a limited number of parties associated with a small administrative unit.
What containment and remediation steps did Harvard report?
Harvard said it applied Oracle's patch after receiving it to remediate the vulnerability. The university is continuing to monitor the situation and says it has no evidence that other University systems were compromised.
Is the alleged data theft independently confirmed?
The Clop ransomware gang listed Harvard on its data leak site and claimed it would release University data. Harvard confirmed awareness of reports of data obtained through the vulnerability, but its investigation remains ongoing.
Is Harvard the only organization affected by this Oracle E-Business Suite issue?
No. Harvard said the issue has affected many Oracle E-Business Suite customers and is not specific to the university.