Envoy Air, subsidiary of American Airlines, experienced a cyberattack. A spokesperson for the organization told Reuters that the company has “conducted a thorough review of the data at issue and have confirmed no sensitive or customer data was affected.” However, it is possible that a “limited amount of business information and commercial contact details may have been compromised.”
The spokesperson also stated that the company is investigating the incident and cooperating with law enforcement.
The Cl0p ransomware group claimed responsibility for this attack. According to Reuters, this attack was the “result of a campaign targeting Oracle E-Business Suite applications.” Envoy Air is the second entity to confirm an attack in relation to the Oracle E-Business Suite hacking campaign.
Shane Barney, Chief Information Security Officer at Keeper Security, shares, “The Envoy Air incident is a reminder of the dependencies organizations have on large, interconnected business systems, and how much risk they entail. When attackers exploit a vulnerability in a widely used platform, like the Oracle system involved here, they’re not just breaching one company; they’re creating a ripple effect across every organization that relies on the same technology.
“The danger goes well beyond stolen data. These attacks disrupt operations, strain internal resources and erode public trust — consequences that linger long after the initial breach. Every hour spent untangling a third-party compromise is time pulled away from protecting the rest of the business.
“Organizations need to understand where their critical systems connect, who has access to them and how that access is managed. Enforcing least-privilege access, continuously monitoring for unusual behavior and implementing strong privileged access controls can stop a single vulnerability from becoming a company-wide crisis. In today’s threat landscape, containment is just as important as prevention.”
Experts at Google believe Envoy Air will not be the last entity to experience issues in relation to the Oracle E-Business Suite applications attacks, asserting it is likely that more than 100 organizations will be affected. Furthermore, these experts state that large amounts of data were taken in an operation that “may have begun as early as three months ago.”
Mr. Mayuresh Dani, Security Research Manager, at Qualys Threat Research Unit, comments, “Oracle E-Business Suite is installed in critical operations for thousands of global enterprises across financial services, healthcare, education, manufacturing, and government sectors. With this low complexity, unauthenticated vulnerability, threat actors had nearly three months (from July 10 to Oct. 4, 2025) to exploit the zero-day before a patch was released. To add fuel to the fire, public proof-of-concept (PoC) exploits were available at least a day before Oracle’s emergency patch.
“Many organizations may not yet know they were compromised during the zero-day period, as threat intelligence suggests large volumes of customer data were successfully exfiltrated. When all the pieces of the recent Oracle EBS vulnerability are put together, we will know that more of the story is yet to unfold.
“Organizations should ensure that the October 2023 Critical Patch Update is installed, deploy Oct. 4, 2025 Security Alert patches for CVE-2025-61882, apply Oct. 12, 2025 patches for CVE-2025-61884 to provide comprehensive coverage, and confirm that the July 2025 Critical Patch Update is deployed to address related vulnerabilities exploited in this Cl0p campaign.”
This incident comes after a data breach against WestJet, a cyberattack against European airports, and warnings of a “sophisticated and aggressive cyber campaign” targeting airlines.