Clop extortion emails claim theft of Oracle E-Business Suite data

**Executive summary:** Mandiant, Google, and GTIG are tracking a high-volume extortion campaign where hundreds of compromised email accounts are sending messages claiming sensitive data was stolen from Oracle E-Business Suite; the messages are linked to the Clop/FIN11 extortion operation, and Oracle indicates the actors likely used vulnerabilities addressed in the July 2025 Critical Patch Update, though confirmed data theft has not been established.