Estée Lauder Discloses Data Breach via Oracle E-Business Suite Vulnerability

Estée Lauder — the world's second-largest cosmetics maker, with annual revenue of $14.3 billion and a workforce of 57,000 — has begun sending out data breach notifications. The cause was a vulnerability in the Oracle E-Business Suite system the company used for HR management.

What happened

According to the company, the intrusion took place around August 9, 2025, but it went undetected for months: the investigation only confirmed the unauthorized access on June 19, 2026. During that time, outsiders obtained the “personal information of certain individuals.”

The list of compromised data is extensive. The sample notification cites full names, mailing and email addresses, dates of birth, Social Security numbers (SSNs), passport numbers, financial information (including bank accounts), medical information, as well as employment data — right down to payroll records and employee performance reviews.

The Clop group's fingerprints

Estée Lauder does not name the vulnerability itself, but the date of the breach coincides with the mass campaign against Oracle E-Business Suite via CVE-2025-61882. Back in October 2025, researchers at Google and Mandiant warned that the Clop group was exploiting this flaw as a zero-day to steal data.

The issue affected EBS versions 12.2.3–12.2.14 and allowed attackers to bypass authentication and execute code remotely through the BI Publisher Integration component, opening access to sensitive HR data. Oracle released patches on October 4, 2025. CrowdStrike later confirmed that Clop had been exploiting the vulnerability since early August.

Other victims of the same campaign include Harvard, the University of Pennsylvania, Dartmouth, the University of Phoenix, The Washington Post, Logitech, GlobalLogic, Cox Enterprises, and Envoy Air (a subsidiary of American Airlines).

Not the first time

This is already Estée Lauder's second run-in with Clop. In 2023, the company fell victim to the exploitation of another zero-day vulnerability — in the MOVEit Transfer file transfer platform.

Those affected are advised to stay alert for signs of identity theft and fraud. The company is offering 24 months of free monitoring through the Kroll service.

Source: Bleeping Computer