Dartmouth College has confirmed that the Clop extortion group stole personal data from its systems after exploiting a zero-day vulnerability in Oracle E-Business Suite (EBS), adding another high-profile victim to a growing campaign against Oracle environments. In a breach notification filed with the Maine Attorney General, Dartmouth says an “unauthorized actor” exfiltrated files between August 9 and August 12, 2025, by exploiting a previously unknown flaw in Oracle EBS, now tracked as CVE-2025-61882.
The college’s review of affected files determined that at least 1,494 individuals had personal information exposed, including names, Social Security numbers, and, in some cases, financial account details. Because the Maine filing only covers state residents, the total number of impacted individuals is expected to be higher. Dartmouth says it identified affected records on October 30 and began sending notification letters on November 24, offering one year of credit monitoring and identity protection services.
The incident is part of a wider Clop campaign targeting Oracle EBS installations at large organizations. Security researchers and media reports have linked the same zero-day exploitation wave to victims including Harvard University, The Washington Post, Logitech, Envoy Air, and other enterprises running Oracle EBS in production. Rather than encrypting systems, Clop has focused on data theft and public extortion, posting leaked archives to its site when negotiations fail. Dartmouth says it has since applied all publicly available Oracle patches related to the incident and plans to increase scrutiny of third-party vendors and their security practices.
For CISOs, the Dartmouth case underscores the concentration risk around widely deployed ERP and identity-adjacent platforms. A single unpatched Oracle estate can expose large volumes of sensitive identity data across HR, finance, and student records. The campaign also illustrates how rapidly exploited zero-days can cascade across multiple organizations before patches are available or fully applied, reinforcing the need for compensating controls such as network segmentation, rigorous monitoring around high-value applications, and strong detection for tools like Cobalt Strike often used for lateral movement in similar operations.
Sources: BleepingComputer, Maine Attorney General, The Register, FireCompass
—
By the ID Tech Editorial Team
