Barts Health NHS Trust has confirmed that 🦠 Clop ransomware actors stole years of invoices after exploiting a zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite.
The exposed data includes:
- 🧍♂️🏠 Full names and home addresses of individuals who paid for treatment
- 👤💸 Information about former employees with outstanding payments
- 🏢📊 Supplier and accounting service files (including for BHRUT since April 2024)
The breach occurred in August, but Barts only learned of the exposure in November, when Clop posted the files on their dark web leak portal.
Barts states:
“There was no indication data was at risk until November… No information has been posted on the general internet.”
They are now seeking a ⚖️ High Court order to block sharing or publication of the stolen data — although such orders have historically limited reach once data is leaked.
🌍 Global Context
Clop has been exploiting this Oracle EBS flaw since early August, impacting organizations such as:
🏫 Harvard University
📰 Washington Post
🎧 Logitech
✈️ Envoy Air
🏛 University of Pennsylvania
…and many more.
🔐What Was Not Affected
Barts confirms that:
- 🏥 Electronic patient records remain secure
- 🧑⚕️ Clinical systems were not impacted
- 🛡 Core IT infrastructure remains protected
Advice for Patients & Individuals 🛑
If you paid Barts for services:
✔️ Review your invoices to see what data may have been exposed
✔️ Watch for 📩 phishing attempts, fake payment requests, or unusual messages
✔️ Do not share personal or financial information with unsolicited contacts
Healthcare continues to be a high-value cyber target. This incident highlights how legacy enterprise vulnerabilities can drive widespread data theft campaigns.
