GlobalLogic hit by Clop’s attack on Oracle clients

Quick Takeaways

1. GlobalLogic was affected by a data theft and extortion campaign exploiting a zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite, exposing sensitive employee data of nearly 10,500 individuals.
2. The attack, linked to the Clop ransomware group, began in July but was only disclosed by Oracle on October 4, revealing an extended period of data theft.
3. GlobalLogic swiftly responded by activating incident procedures, notifying authorities, and applying Oracle’s patches, though some data, including personal and payment details, was compromised.
4. The widespread nature of the attack highlights ongoing risks for Oracle customers, with Clop demanding multi-million dollar ransoms and threatening to leak victim data.

What’s the Problem?

GlobalLogic, a notable digital engineering firm with nearly 600 clients and acquired by Hitachi in 2021, fell victim to a large-scale data theft and extortion campaign that exploited a hidden vulnerability in Oracle E-Business Suite. The attack, linked to the notorious Clop ransomware group, targeted multiple organizations by leveraging a zero-day flaw—CV (Common Vulnerabilities and Exposures) CVE-2025-61882—that Oracle had only publicly patched on October 4. Discovered by GlobalLogic on October 9 and traced back to initial breaches on July 10, the intrusion led to the compromise of sensitive employee data for around 10,500 current and former staff, including personal details like Social Security numbers, passport info, and bank data. The attackers, having exploited the vulnerability over several months, demanded hefty ransoms, with some exceeding $50 million as per cybersecurity reports, and publicly threatened to leak data from multiple victims, such as Envoy Air, unless paid.

The incident happened because the Clop group managed to exploit a security flaw before it was patched, revealing weaknesses in Oracle’s platform and highlighting the risks of zero-day vulnerabilities being weaponized over extended periods. After confirming the breach, GlobalLogic immediately activated its incident response, involving law enforcement and cybersecurity experts, and swiftly applied the available patch from Oracle once released. While Oracle acknowledged the vulnerability and issued a fix, the delay allowed malicious actors to harvest vast amounts of data from multiple victims, leading to widespread concern about the prolonged window of exposure. This incident underscores the ongoing threat posed by advanced cybercriminal groups exploiting unpatched software and demonstrates the importance of rapid response and proactive security measures to mitigate damage from such attacks.

Potential Risks

The recent attack spree by the cybercriminal group Clop targeting Oracle customers, which has significantly impacted Hitachi’s subsidiary GlobalLogic, underscores a peril that any business with digital assets or cloud-based services must heed—cyber threats are highly pervasive and can swiftly disrupt operations, compromise sensitive data, and cause severe financial and reputational damage. If your business relies on third-party vendors, enterprise software, or cloud providers, a breach can cascade through your supply chain, exposing proprietary information or disrupting service delivery, leading to customer trust erosion and regulatory penalties. The global scale of Clop’s ransomware campaigns illustrates that no organization—regardless of size or industry—is immune; without robust cybersecurity measures and vigilant monitoring, an attack could strike unexpectedly, forcing costly recovery efforts, damaging customer confidence, and jeopardizing your competitive standing.

Possible Next Steps

In the rapidly evolving landscape of cybersecurity threats, prompt remediation is critical to minimizing damage, restoring trust, and preventing further exploitation. For Hitachi’s subsidiary, GlobalLogic, which has been affected by Clop’s targeted attack on Oracle customers, swift and effective action is essential to safeguard sensitive data and maintain operational integrity.

Assessment & Containment

• Conduct immediate incident assessment to understand the scope and impact.
• Isolate compromised systems to prevent lateral movement.
• Disable affected accounts and secure access points.

Communication & Notification

• Notify relevant stakeholders, including customers, partners, and regulators, as required.
• Prepare clear, transparent communication to maintain trust.

Eradication & Recovery

• Remove malicious artifacts and close exploited vulnerabilities.
• Patch affected systems, especially Oracle applications and related infrastructure.
• Restore systems from clean backups ensuring data integrity.

Monitoring & Prevention

• Implement continuous monitoring to detect ongoing or subsequent threats.
• Update security controls, including intrusion detection and prevention systems.
• Strengthen access controls and enforce multi-factor authentication.

Policy & Training

• Review and enhance cybersecurity policies and procedures.
• Provide targeted training to staff on recognizing and responding to cyber threats.

Documentation & Review

• Document the incident thoroughly for compliance and future reference.
• Conduct post-incident analysis to identify lessons learned and strengthen defenses.

Advance Your Cyber Knowledge

Explore career growth and education via Careers & Learning, or dive into Compliance essentials.

Explore engineering-led approaches to digital security at IEEE Cybersecurity.

Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.

Cyberattacks-V1cyberattack-v1-multisource