The Cl0p ransomware group has listed the UK's National Health Service (NHS) as a victim on its dark web leak site, in the latest attack linked to flaws in Oracle's E-Business Suite (EBS) software. The group posted the claim on 11 November 2026, accusing the NHS of neglecting its security. The NHS has not confirmed a breach and says it is investigating the claim.

Hackread reports that the group has since leaked 241 GB of data it says came from the NHS, and that Barts Health NHS Trust has confirmed its data was stolen. The NHS's cybersecurity division had already warned health and public sector organisations in October to patch critical Oracle EBS flaws and restrict internet exposure of affected systems.

What Cl0p claims about the NHS

Cl0p's post accused the health service of ignoring security, stating: "The company doesn't care about its customers; it ignored their security." The group did not initially say how much data it had taken. The claim fits a wider campaign in which Cl0p has targeted organisations running Oracle EBS, exploiting a critical remote code execution flaw tracked as CVE-2025-61882, which carries a CVSS score of 9.8.

Security researchers say exploitation of the flaw began around August 2025, months before Oracle issued an emergency patch on 4 October. The affected versions range from 12.2.3 to 12.2.14, with attackers focusing on the BI Publisher Integration module, which allows unauthenticated access to vulnerable systems. The spread accelerated after a group called Scattered Lapsus$ Hunters leaked proof-of-concept code on 3 October.

Washington Post breach confirmed

Days earlier, on 7 November, Cl0p announced it had breached The Washington Post using the same Oracle EBS flaws, publishing what it claims is 183 GB of data under a folder labelled "ebs.washpost.com". The newspaper later confirmed it was among the victims of a breach of the Oracle E-Business Suite platform.

A filing with the Maine Attorney General's Office on 11 November confirmed that 9,720 people were affected in the Washington Post incident, with exposed information including names, bank account numbers and routing numbers, Social Security numbers and tax ID numbers. Other organisations named in the campaign include Harvard University and Envoy, American Airlines' subsidiary. Investigations by Mandiant and Google's Threat Intelligence Group suggest the activity started in late September 2025.

What organisations should do

Experts advise organisations running Oracle EBS to install the October 2025 patch immediately, carry out forensic reviews dating back to August, and watch for connections to suspicious IP addresses flagged in the investigation. Oracle has released patches for the vulnerabilities and urged customers to update without delay, but researchers warn many systems remain exposed.

Source links: Hackread and Cybernoz.