Michelin data breach (March 2026): the Oracle E-Business Suite zero-day
In March 2026 Michelin confirmed it was among the victims of Cl0p’s campaign against Oracle E-Business Suite.
Short answer
Was Michelin hacked?
Yes. Michelin confirmed a data breach after attackers exploited a zero-day vulnerability in Oracle E-Business Suite, part of Cl0p’s campaign against EBS customers.
Cl0p claimed the attack. Reporting cites about 315 GB leaked, which Michelin has not confirmed.
Timeline at a glance
11 Mar 2026Michelin confirms a breach via an Oracle EBS zero-day. (SecurityWeek)Confirmed
Mar 2026~315 GB reportedly leaked by Cl0p. (UpGuard)Unverified claim
Last updated October 31, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Michelin’s security posture at the time
What Michelin publicly said about its security certifications and controls, how big it is, and how its shares moved, each tied to a source. A certificate covers a stated scope at a point in time; it is not a guarantee about every system. Reviewed 31 October 2026. Compare all 2026 breaches.
Security certifications publicly held
No public certification found.
No public certification found on the company’s own security, trust or compliance pages, in filings, or in the certificate registries searched (BSI, CSA STAR). That is a data point, not proof that none exists.
No reliable report of a share-price move around the disclosure was found.
Michelin incident timeline, in detail
Confirmed = acknowledged by Michelin, a regulator filing or a court. Reported = credible reporting Michelin has not fully confirmed. Unverified claim = an attacker or leak-site claim.
11 Mar 2026ConfirmedThird-party software / zero-day
Oracle E-Business Suite zero-day exploited by Cl0p
What happened. Michelin confirmed a data breach after attackers exploited a zero-day in Oracle E-Business Suite, part of the Cl0p campaign against EBS customers. Cl0p claimed the attack; reporting cites about 315 GB leaked, a figure Michelin has not confirmed.
Impact. Data stolen from Michelin’s EBS environment; volume not confirmed. People or records affected: Not disclosed.
We found no SOC 2 or ISO 27001 certification published by Michelin. That does not prove it had none; it means none was public.
The weak link was in the software supply chain
The entry point was a dependency, token or third-party software rather than the company’s own front door. Certification scopes usually cover the company’s management system; the integrity of every package, token and developer workstation is a control that has to be checked separately.
What it means for Michelin Michelin suppliers, dealers and business customers — and what to do
What Michelin’s customers, partners and security teams can do now, based only on what has been disclosed.
1.Check whether you used the same component
If the incident involved a named package, token or product, check your own inventory for the same component and versions.
2.Rotate shared secrets
Rotate any credentials, tokens or keys shared with the affected company until it confirms they were not exposed.
3.Ask the supplier for its findings
Ask what was taken, whether code-signing or update channels were affected, and what you need to update.
Yes. Michelin confirmed a data breach after attackers exploited a zero-day vulnerability in Oracle E-Business Suite, part of Cl0p’s campaign against EBS customers.
Did Michelin have SOC 2 or ISO 27001 certification?+
We found no SOC 2 or ISO 27001 certification published by Michelin. That does not prove it had none; it means none was public.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Michelin. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout