Clop's Oracle EBS rampage reaches Dartmouth College

Dartmouth College has confirmed it's the latest victim of Clop's Oracle E-Business Suite (EBS) smash-and-grab. According to a breach notification filed with Maine's attorney general, the New Hampshire Ivy League university says crooks exploited a now-patched zero-day in Oracle EBS and made off with data from its environment between August 9 and August 12. Dartmouth's review found that at least 1,494 Maine residents had their names, Social Security Numbers, and, in some cases, financial account information stolen, though it hasn't said how many people were affected overall. The letter notes that Dartmouth immediately secured its systems, notified law enforcement, and later confirmed that multiple files had been exfiltrated during the three-day window. The university began sending out notification letters on November 24 and is offering one year of credit monitoring to those whose SSNs were exposed. Dartmouth's admission cements what has already become clear: Clop's Oracle EBS raid was a sprawling campaign with a long list of victims. Earlier this month, The Washington Post disclosed that nearly 10,000 employees and contractors were caught up in the same wave of attacks, which followed earlier confirmations from the likes of Hitachi-owned GlobalLogic and Allianz UK. Earlier this week, Cox Enterprises also came out as a victim, saying Clop had bagged the data of almost 10,000 individuals. Clop's MO has become all too familiar. The Russia-linked cybercrime crew has repeatedly targ...