Canon Allegedly Breached by Clop Ransomware via Oracle E-Business Suite 0-Day Hack
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Canon has officially confirmed that it was targeted during the widespread hacking campaign exploiting a critical zero-day vulnerability in Oracle E-Business Suite (EBS)<\/a>.<\/p>\n The attack, orchestrated by the notorious Clop ransomware gang, has impacted dozens of major organizations worldwide. The group listed Canon on its dark web leak site, publishing the company\u2019s domain alongside other alleged victims.<\/p>\n While the listing on the leak site raised concerns about a massive data breach, Canon clarified that the impact was contained. The camera and imaging giant stated that the compromise affected only a specific environment within one of its subsidiaries.<\/p>\n According to the company, the attackers did not encrypt the broader network or disrupt global operations, which distinguishes this incident from the devastating Maze ransomware attack Canon suffered in 2020.<\/p>\n Canon\u2019s security team detected the intrusion and immediately isolated the affected systems. In a statement shared with SecurityWeek, the company emphasized that the breach did not spread beyond a web server operated by a Canon U.S.A., Inc. subsidiary.<\/p>\n The rapid containment likely prevented the theft of sensitive customer data or intellectual property, which the Clop group often seeks for extortion.\u200b<\/p>\n \u201cWe have confirmed that the incident only affected the web server, and we have already taken security measures and resumed service,\u201d Canon said. \u201cIn addition, we are continuing to investigate further to ensure that there is no other impact\u201d.\u200b<\/p>\n The vulnerability used in this campaign is tracked as CVE-2025-61882<\/a>, a critical security flaw in Oracle E-Business Suite. This zero-day allowed unauthenticated attackers to execute arbitrary code remotely on vulnerable servers.<\/p>\n Security researchers discovered that Clop affiliates, tracked as Graceful Spider, began exploiting this flaw as early as August 2025 to plant web shells and exfiltrate data before Oracle could issue a patch in October.\u200b<\/p>\nThe Oracle EBS Zero-Day Exploit<\/strong><\/h2>\n