Google has issued a critical cybersecurity alert, warning corporate executives and IT leaders about a growing wave of extortion emails falsely claiming to have stolen sensitive data from Oracle E-Business Suite. The tech giant revealed that the large-scale email campaign references Oracle’s enterprise apps and appears to be linked to the cl0p ransomware group, though the claims remain unverified.
According to Google, the attackers are sending phishing-style extortion messages to executives across multiple industries, demanding massive ransom payments in exchange for not leaking allegedly stolen corporate data. The company emphasized that there is “no concrete evidence” confirming the data breach and urged recipients to remain vigilant and avoid engaging with the senders.
Cybersecurity researchers have observed ransom demands ranging from millions to as high as $50 million, highlighting the growing trend of AI-powered social engineering and cyber extortion scams. Cynthia Kaiser, Head of the Ransomware Research Center at Halcyon, noted that overlapping cybercrime groups and copycat actors are complicating attribution, warning that cybercriminals are exploiting fear and misinformation to extort businesses.
Experts recommend organizations using Oracle E-Business Suite or other enterprise resource planning (ERP) systems immediately review access logs, implement multi-factor authentication, and ensure the latest security patches are applied. Security teams are also advised to preserve email evidence, report incidents to authorities, and enhance email threat detection systems to prevent further exposure.
Google’s latest warning underscores the growing scale of ransomware threats and phishing attacks targeting enterprise IT systems, urging companies to strengthen their cyber resilience, data protection, and incident response strategies in the face of evolving digital threats.
