University of Phoenix Data Breach: 3.5M Individuals Affected

Ripples from a mass attack on Oracle E-Business Suite software by a Russian-speaking ransomware gang continue to be felt across the United States, with for-profit University of Phoenix adding itself to a growing list of victims.

The private learning institution will notify 3.5 million current and former students, employees, faculty and suppliers that their personal information was swept up in the attack. The University of Phoenix said the breach, which it discovered in November, occurred in August.

See Also: Top 10 Technical Predictions for 2025

Its disclosure states that it first learned on Nov. 21 that “an Oracle E-Business Suite software vulnerability may have resulted in a cybersecurity incident.” On Nov. 24, they confirmed that “an unauthorized third party exploited a previously unknown software vulnerability in Oracle EBS to exfiltrate certain data within the University’s Oracle EBS environment” between Aug. 13 and Aug. 22.

Compromised data includes individuals’ name, date of birth, Social Security number, and bank account and routing numbers. “We are reviewing the impacted data and will provide the required notifications to affected individuals and regulatory entities,” Andrea Smiley, vice president for public relations at University of Phoenix, told Information Security Media Group.

The institution didn’t attribute the attack to any individual or entity, but the ransomware group Clop, aka Cl0p, listed the University of Phoenix as a non-paying victim on its data-leak blog. Other universities affected by the campaign include Harvard and Tulane, as well as South Africa’s University of the Witwatersrand.

Victims of Clop’s campaign and details of the resulting data exposure keep coming to light. Last week, Tennessee-based automotive parts and services giant LKQ disclosed that it fell victim to an attack against its Oracle EBS software that appeared to occur on Aug. 9, and which it detected on Oct. 3.

LKQ said the breach resulted in the theft of data pertaining to 9,070 sole proprietor suppliers to LKQ, including their Employer Identification Number or Social Security number.

Clop claimed credit for LKQ’s breach, as it has also done with dozens of other organizations that declined to pay it a ransom. How many victims acceded to its demands and paid a ransom remains an open question.

Further known victims of Clop’s Oracle EBS-targeting campaign include medical device-maker Abbott, American Airlines subsidiary Envoy Air, technology giants Broadcom and Cox Enterprises, French giant Schneider Electric, Britain’s National Health Service, as well as Oracle itself.

Clop’s Campaigns

Clop, which researchers also track as TA505, FIN11 and Graceful Spider, has a history of rapidly stealing data from numerous victims at once, typically by targeting one or more zero-day vulnerabilities in a single type of widely used software.

Security researchers still classify Clop began as being a ransomware group, but say instead of using crypto-locking malware, the group specializes in supply-chain attacks, often concentrating on secure managed file-transfer software to steal data from a large number of users at once. Past campaigns include hacks of Accellion FTA from late 2020 to early 2021, GoAnywhere Managed File Transfer software in early 2023, Progress Software’s MOVEit and Cleo Communications’ Harmony in mid-2023, and VLTrader and LexiCom MFT software in late 2024.

The first signs of Clop’s campaign targeting Oracle EBS users emerged on Sept. 29, when individuals claiming to be affiliated with the group began emailing extortion notes to victim organizations, threatening to leak stolen data unless they paid cryptocurrency ransoms worth up to $50 million.

The shakedown showed signs of extensive preparation and planning. “The emails were sent from compromised business email accounts or newly registered accounts but contained authentic contact points with ransomware operators,” as published on Clop’s data-leak site, said threat intelligence firm Resecurity.

Threat researchers at Google said credentials for the email accounts “were likely sourced from infostealer malware logs sold on underground forums.”

They subsequently found signs that Clop’s first EBS-targeting attacks may have begun by July 10 and that “in some cases, the threat actor successfully exfiltrated a significant amount of data from impacted organizations,” potentially adding up to more than 100.

Oracle initially said that organizations running a fully patched version of EBS weren’t at risk. But the technology giant reversed course, acknowledged that a zero-day vulnerability tracked as CVE-2025-61882 was part of an attack chain. It published emergency patches, including for a second zero-day vulnerability tracked as CVE-2025-61884 and urged all users to immediately update.

Security experts said all Oracle EBS users must hunt for signs of intrusion, to ensure attackers hadn’t already gained access and deployed other means for regaining access later.

Previous Clop attacks showed the group prioritized targeting a large number of organizations, across geographies and sectors, Caitlin Condon, vice president of security research at cybersecurity firm VulnCheck, told Information Security Media Group.

“The Oracle EBS attack seems to have followed that same pattern, with alleged Clop victims spanning global organizations across healthcare, manufacturing, financial and professional services, higher education, IT software and more,” Condon said.