The Oracle Campaign Named Another One

Logitech confirmed in November 2025 that an unauthorised third party had used a zero-day vulnerability in a third-party software platform to copy data from its internal IT systems, including limited information about employees, consumers, customers and suppliers. The Cl0p extortion group claimed the attack as part of its Oracle E-Business Suite campaign.

The corpus filed the campaign model at 25-1007: exploit every reachable instance in a short window, then name victims progressively over months to sustain pressure and maximise separate negotiations.

Logitech is that model working. The exploitation was months earlier; the disclosure came when the company was named. For most of that interval the organisation was a victim of an incident that had already happened and had not yet surfaced.

It makes the campaign uncountable in real time, per 25-1230, and it is engineered rather than incidental.

Employees, consumers, customers and suppliers. Four populations named.

This desk filed at 25-0704 that workforce data is systematically under-recorded and at 25-1204 that supplier and commercial data triggers nothing. A company naming all four in one statement is describing the actual contents of an ERP estate — the point at 25-0424 that this is the system of record, not a copy of something.

This desk argued at 25-0214 that a previously unknown vulnerability genuinely limits what a customer could have prevented, and does not answer why the product was internet-reachable, why data persisted on it, or whether exfiltration would have been detected without being told.

Those remain architecture and retention decisions the customer owned, and they determine what a zero-day is worth to whoever finds it.