Estée Lauder, the global cosmetics firm, has confirmed a data breach stemming from an exploited vulnerability in its Oracle E-Business Suite (EBS) system, which the company utilized for human resources (HR) operations. The company's investigation determined that an unauthorized third party gained access to the system and obtained personal information of certain individuals on or around August 9, 2025. Estée Lauder identified the intrusion last month, on June 19, 2026.
The exposed data, according to a sample of the disclosure letter, includes full names, postal addresses, email addresses, dates of birth, Social Security numbers (SSNs), and passport numbers. Additionally, financial account information, including bank account numbers, health information, and employment details such as payroll and performance reports, were compromised.
While Estée Lauder's notification did not specify the exact vulnerability, the timing of the breach aligns with a widespread exploitation campaign targeting Oracle EBS through CVE-2025-61882. This flaw, affecting EBS versions 12.2.3 through 12.2.14, allowed attackers to bypass authentication and execute code remotely via the BI Publisher Integration component, potentially granting access to sensitive HR and business data.
Google and Mandiant researchers issued warnings in October 2025 about breaches linked to the Clop ransomware group, which was exploiting CVE-2025-61882 as a zero-day. Oracle released patches for this vulnerability on October 4, 2025. Cybersecurity firm CrowdStrike subsequently confirmed that Clop had been actively exploiting the flaw since early August 2025.
Other organizations reportedly impacted by the same campaign include Harvard, the University of Pennsylvania, Dartmouth, the University of Phoenix, The Washington Post, Logitech, GlobalLogic, Cox Enterprises, and American Airlines subsidiary Envoy Air.
Estée Lauder is advising individuals who received breach notifications to monitor for signs of identity theft and fraud. The company is also providing 24 months of complimentary identity monitoring services through Kroll.
This incident marks the second time Estée Lauder has been compromised by the Clop ransomware group. In 2023, the group exploited another zero-day vulnerability in the MOVEit Transfer platform, a software tool used by the company.
