Dartmouth College on Tuesday confirmed suffering a data breach after cybercriminals targeted its Oracle E-Business Suite (EBS) instance.
The Ivy League research university said it uses Oracle EBS to manage its operations, and its EBS instance was targeted in the recent zero-day attack between August 9 and August 12.
Dartmouth College determined in late October that the attackers managed to exfiltrate files containing personal and financial information, including Social Security numbers.
The university told the Maine Attorney General that nearly 1,500 residents of the state are impacted. In New Hampshire, authorities were told that more than 31,000 people are affected. The total number of affected people has not been disclosed.
The Cl0p ransomware group, which is the public-facing entity taking credit for the Oracle EBS campaign, has been listing victims on its leak website.
More than 100 alleged victims have been named to date, and for more than half cybercriminals have leaked data allegedly stolen from their systems.
In the case of Dartmouth, the cybercriminals made public 226 Gb of archives containing files allegedly stolen from the university. SecurityWeek has not downloaded the files, but a brief file tree and metadata analysis suggests that the data does come from Dartmouth.
In addition to Dartmouth, the Cl0p website names Southern Illinois University, Harvard University, and Tulane University as victims of the Oracle hack. Harvard already confirmed that it was hit. Southern Illinois University was also targeted in the 2023 MOVEit campaign, which was attributed to the same threat actor.
Canon and Mazda confirmed to SecurityWeek in recent days that they have also been targeted in the Oracle campaign, but the carmaker said it found no evidence of data leakage.
*updated with the number of people impacted in New Hampshire
Related: Cox Confirms Oracle EBS Hack as Cybercriminals Name 100 Alleged Victims
Related: Logitech Confirms Data Breach Following Designation as Oracle Hack Victim
Related: Washington Post Says Nearly 10,000 Employees Impacted by Oracle Hack
