Major Breach Exposes Data of 618,000 in Oracle E-Business Suite Incident

In a major cybersecurity incident, the University of Phoenix has confirmed a breach tied to the exploitation of a zero-day vulnerability (CVE-2025-61882) in Oracle's E-Business Suite. Approximately 618,000 records were compromised, exposing sensitive personally identifiable information (PII) of students, staff, and vendors. The breach was identified when exfiltrated data began appearing on an extortion site in November 2025, raising alarms about the adequacy of the institution's security protocols. Oracle has since issued patches for this vulnerability, urging all users to update their systems immediately to mitigate further risk. This incident emphasizes the critical need for vigilant patch management and monitoring of sensitive data access within educational institutions and beyond. Weekly Cybersecurity Intelligence Report.

Also In Security Today

• 700Credit API Vulnerability: A significant data breach at 700Credit has exposed data of over 5.6 million individuals due to a flawed API connection. This incident highlights the risks associated with API security. SWK Cybersecurity News Recap
• BRICKSTORM Malware Campaign: CISA and the NSA have warned about a sophisticated malware campaign from Chinese state-sponsored actors targeting VMware and Windows systems, underscoring the need for heightened defense measures against state-sponsored threats. Global Cyber Threats: December 2025 roundup
• Coupang Data Breach: Coupang, South Korea’s leading e-commerce platform, confirmed a breach affecting nearly 34 million customer records, reportedly facilitated by a former employee. This raises concerns about insider threats. Cybersecurity News December 2025
• French Interior Ministry Attack: A cyberattack disrupted the French Interior Ministry's email servers, leading to enhanced security protocols amidst fears of data theft. Cybersecurity Roundup, December 2025.

Analyst's Take

Today's breach at the University of Phoenix serves as a stark reminder of the vulnerabilities inherent in widely-used enterprise software. As attackers become increasingly sophisticated, organizations must prioritize timely patch management and rigorous monitoring of data access. The trends emerging from these incidents—particularly the exploitation of APIs and insider threats—reinforce the need for comprehensive cybersecurity frameworks that encompass not just technical defenses but also user training and awareness. Security teams should review their incident response strategies and ensure robust logging and monitoring practices to detect early signs of compromise.