UPenn joins long list of Clop victims after Oracle EBS raid

The University of Pennsylvania has become the latest victim of Clop’s raid on Oracle’s E-Business Suite (EBS) customers. The Ivy League school has now warned more than a thousand people that their personal information had been stolen from its systems.

In a data breach notification letter filed with the Maine Attorney GeneralAccording to Penn, attackers exploited a zero-day in Oracle’s EBS – the same flaw that Clop bragged about to breach hundreds of organizations around the world – and stole data stored in the university’s platform instance, which it uses to process “vendor payments, refunds, general ledger entries, and conduct other university business.”

Penn launched an investigation, patched its systems after Oracle issued fixes, and alerted federal law enforcement. The university said it discovered on November 11 that personal information had been stolen from its systems.