Estée Lauder reports data breach from Oracle E-Business Suite vulnerability

Details of the Data Breach

Estée Lauder has reported that hackers exploited a vulnerability in Oracle E-Business Suite, which the company utilized for its HR operations. The intrusion, detected on June 19, 2026, allows access to sensitive personal data that occurred on August 9, 2025.

Nature of Exposed Information

The data breach included full names, addresses, email addresses, dates of birth, Social Security numbers, passport numbers, and financial account details, among other sensitive information. This broad exposure raises concerns about identity theft and financial fraud for those affected.

Vulnerability Context

The breach correlates with mass exploitation campaigns targeting Oracle E-Business Suite, specifically linked to CVE-2025-61882. This vulnerability, affecting EBS versions 12.2.3 to 12.2.14, allowed attackers to bypass authentication measures and execute code remotely, which enabled them to access sensitive business and HR data.

Response and Recommendations

Estée Lauder has advised individuals affected by the data breach to stay vigilant for potential signs of identity theft and fraud. They encouraged recipients of the notification letter to monitor their accounts closely, although the notification did not detail specific mitigation steps being undertaken by the company.

Broader Implications

This incident highlights the ongoing risks associated with vulnerabilities in widely used software solutions like Oracle E-Business Suite. Other high-profile organizations affected by similar attacks underscore the urgent need for heightened cybersecurity measures across industries.