Washington Post hit in major Oracle E‑Business Suite cyber breach

The Washington Post has acknowledged it is one of the victims of a sweeping cyber‑breach tied to the Oracle Corporation E‑Business Suite platform — a revelation that underscores the growing scale and sophistication of supply‑chain cyber‑attacks. In a terse statement released on Thursday, the newspaper said it was “impacted … by the breach of the Oracle E‑Business Suite platform.”

While the Post stopped short of providing further details, the incident arrives after the notorious ransomware‑and‑extortion group CL0P listed the newspaper on its website among recent victims. CL0P is alleged to be at the centre of a broad campaign exploiting vulnerabilities in Oracle’s E‑Business Suite software — used globally to manage customers, suppliers, manufacturing and logistics operations.

According to cybersecurity investigations, this campaign may have been underway since mid‑2025. A critical zero‑day vulnerability in Oracle’s E‑Business Suite allowed remote code execution without authentication, enabling attackers to compromise systems and exfiltrate data. It is estimated that more than 100 organisations could be affected.

The modus operandi of CL0P in this campaign appears to follow a familiar pattern: gain access to enterprise applications, quietly exfiltrate data, then issue extortion demands and threaten publication of stolen files unless payment is made.

For The Washington Post, the exact nature and volume of the data compromised remains unreported. The statement did not clarify which systems were breached or whether any personal, financial or confidential subscriber data were accessed.

This incident will raise fresh questions for organisations running legacy enterprise applications—especially when those systems are exposed to the internet or lack up‑to‑date patches. The breach also highlights the increasingly blurred line between software‑supply vulnerabilities and large‑scale cyber‑extortion campaigns.