Oracle EBS 2025 campaign impacts Madison Square Garden, sensitive data leaked
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-61882 | Unauthenticated Takeover of Oracle E-Business Suite Concurrent Processing CVE-2025-61882 is a critical (CVSS 9.8) authentication flaw (CWE-287) in the BI Publisher Integration component of the Oracle Concurrent Processing product within Oracle E-Business Suite. An unauthenticated attacker with network access over HTTP can exploit it remotely with no credentials and no user interaction, achieving a takeover of Oracle Concurrent Processing with high confidentiality, integrity, and availability impact. Any organization running Oracle E-Business Suite 12.2.3 through 12.2.14 is affected, especially instances reachable from the internet. The flaw is being actively exploited in the wild: the Cl0p data-theft group has used it to breach dozens of organizations (including Harvard University, with 1.3 TB of data leaked), CISA added it to the Known Exploited Vulnerabilities catalog on 2025-10-06 with known ransomware use, and EPSS puts its 30-day exploitation probability at 99.7%. Do: Apply Oracle's released patch or mitigations for CVE-2025-61882 to affected E-Business Suite 12.2.3-12.2.14 deployments as instructed by the vendor; per CISA KEV requirements, federal agencies must follow BOD 22-01 guidance or discontinue use if mitigations are unavailable. Until patched, limit internet exposure of EBS and its BI Publisher/Concurrent Processing HTTP endpoints, and review web and application logs for unauthenticated access and signs of Cl0p-style data theft or follow-on ransomware. | 9.8 | 100% | KEV ransomware |
| largetens of thousands of EBS environments worldwide across an estimated ~5,000+ customer organizations (est.) |
Full article473 words · extracted from securityaffairs.com · click to collapse
Madison Square Garden confirmed a data breach tied to the 2025 Oracle E-Business Suite hacking campaign.
Madison Square Garden (MSG) has confirmed it was affected by a data breach linked to the 2025 cybercrime campaign targeting Oracle’s E-Business Suite (EBS) customers.
Madison Square Garden (MSG) is a world-famous multi-purpose indoor arena located in New York City, USA. It hosts sports events, concerts, and entertainment shows. MSG is home to the New York Knicks (NBA) and New York Rangers (NHL) and is renowned for its history, iconic location, and large-scale live events.
The incident, disclosed months after the initial attacks, places the company among numerous organizations compromised in the large-scale hacking operation exploiting Oracle EBS environments.
In the Oracle EBS hacking campaign, the Cl0p ransomware group exploited zero-day flaws to access data from over 100 organizations, including MSG, in November 2025. MSG refused to pay the ransom, then the extortion group leaked more than 210GB of the company’s archived files, exposing sensitive information.
“The Oracle eBusiness Suite, hosted and managed for us by a vendor, is used for certain workforce and financial operations. Oracle notified its customers that a previously undisclosed condition in the application had been exploited by an unauthorized person to gain access to data from the application. There are reports that this occurred at over 100 companies.” reads the data breach notification letter sent to the Maine Attorney General’s Office. “Our vendor began an investigation, and a forensic firm was also engaged. The investigation determined in late November 2025 that an unauthorized person gained access to some data from the application in August 2025. What Information Was Involved? We reviewed the files, which were part of business records related to hiring or payments made to individuals, and in December 2025, determined that a file containing your name and Social Security number was involved.”
In October 2025, Oracle released an emergency patch to address a critical vulnerability, tracked as CVE-2025-61882 (CVSS 9.8) in its E-Business Suite.
The flaw was exploited by the Cl0p ransomware group in data theft attacks. Unauthenticated remote attackers can exploit the flaw to take control of the Oracle Concurrent Processing component.
Madison Square Garden alerted law enforcement and began notifying affected individuals after a third-party vendor confirmed that hackers had stolen personal data from its Oracle EBS system in August 2025.
MSG is offering affected individuals a complimentary one-year credit monitoring, report, and score through Cyberscout, a TransUnion company, to help detect misuse of personal information and provide identity theft protection. Instructions to activate the service and additional recommended steps are provided in the following pages.
“We confirmed that our vendor successfully implemented measures recommended by Oracle for the application to prevent a recurrence. We also notified law enforcement.” concludes the letter.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, MSG)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/188814/cyber-crime/oracle-ebs-2025-campaign-impacts-madison-square-garden-sensitive-data-leaked.html