Who is behind the attack?
Google said that the ransomware group Klopp may be behind the attack. However, the company made it clear that the claim could not be verified due to a lack of sufficient evidence.
Klopp is already notorious worldwide. They have repeatedly hacked the servers of large organizations, stealing data and demanding ransom. The group was also responsible for attacks on several organizations in the United States and Europe in 2023.
How does this email extortion work?
The Google Threat Intelligence Group said the email campaign began in June and has now become “high-volume.” Hackers are sending these messages using lost or stolen third-party email accounts. The messages claim to have sensitive business and customer information from victims. They ask for direct contact, without specifying a specific amount. The email addresses match those of known leak sites belonging to the Klop group.
Experts say these emails contain grammatical errors and weak language, making them relatively easy to distinguish from genuine corporate emails.
Oracle's previous weaknesses
Oracle has been the victim of multiple cyberattacks recently. In March 2025, a major hacking incident resulted in the theft of customer login information. The FBI and cybersecurity firm CrowdStrike joined the investigation. Oracle has previously publicly acknowledged its data breaches.
Analysts believe that hackers are taking advantage of this vulnerability to create new pressure.
Google said it was conducting a proper investigation into the incident but could not immediately confirm whether the hackers' claims were true. The company called it a "high-risk cyber campaign."
Cybersecurity experts have issued some advice to executives and officials of large organizations, warning them:
Do not click on emails from unknown senders.
If you receive a suspicious email, immediately notify the IT department.
Increase cybersecurity awareness among employees across the organization.
Follow multi-factor authentication and strong password policies.
Such extortion campaigns targeting top executives in the technology and financial sectors could pose serious risks not only to the organizations themselves, but also to the global economy and information security. If such attacks are effective, especially against multinational companies and banks, they could put the personal and financial information of billions of customers at risk.
