Clop Ransomware Hits Barts Health NHS via Oracle Zero-Day

In early 2024, Barts Health NHS Trust disclosed a data breach after Clop ransomware actors exploited a zero-day vulnerability in Oracle E-Business Suite. The attackers gained unauthorized access to internal systems, exfiltrated sensitive files from a key database, and threatened further leaks. The attack leveraged unpatched software flaws as the entry vector, allowing for rapid lateral movement and data theft before being detected. The incident disrupted operations and triggered regulatory notifications due to the sensitive nature of patient and operational information.

This breach highlights the ongoing risks posed by sophisticated ransomware groups exploiting zero-day vulnerabilities in widely used enterprise software. Attacks of this kind are increasingly common, especially in the healthcare sector, which remains a high-value target for ransomware due to legacy systems and critical service mandates.

Attacks exploiting zero-day software vulnerabilities are accelerating, with ransomware groups targeting healthcare organizations' unpatched systems. The Barts incident demonstrates how agile threat actors can bypass traditional defenses and underscores the urgent need for timely vulnerability management, zero trust principles, and resilient incident response strategies.