Breach Estée Lauder customer data compromised in Oracle E-Business Suite breach July 21, 2026 Share By SC Staff (Adobe Stock) As noted by Bleeping Computer, cosmetics giant Estée Lauder is informing customers about a data breach that occurred due to a vulnerability in Oracle's E-Business Suite, which the company utilized for its human resources operations. The intrusion, identified last month, took place on August 9, 2025, leading to the exposure of personal information belonging to certain individuals. The breach at Estée Lauder, a New York-based cosmetics firm with $14.3 billion in annual revenue, resulted from the exploitation of a vulnerability in Oracle E-Business Suite, specifically impacting versions 12.2.3 through 12.2.14. The flaw, identified as CVE-2025-61882, allowed attackers to bypass authentication and execute remote code, granting access to sensitive HR data. Exposed information includes full names, postal and email addresses, dates of birth, Social Security numbers, passport numbers, financial account details, health information, and employment records. This incident aligns with a broader campaign targeting Oracle E-Business Suite, with the Clop ransomware gang previously identified as exploiting this zero-day vulnerability. Oracle released patches for the vulnerability on October 4, 2025, after the breach had already occurred. Estée Lauder is offering 24 months of complimentary identity monitoring services to affected individuals and advises vigilance against identity theft and fraud. Source: Bleeping Computer SC Staff Related Breach Craneware confirms customer and employee data exposed in security incident SC Staff July 20, 2026 The breach, which occurred on July 20, saw a significant volume of file names viewed and exfiltrated by unauthorized individuals. Breach Ernst & Young data breach exposes client tax information SC Staff July 17, 2026 The breach was detected on April 23 when Ernst & Young noticed anomalous activity on its networks. Breach TriWest Healthcare confirms data breach affecting 12,000 TRICARE beneficiaries SC Staff July 17, 2026 The breach allowed an unauthorized individual to access and download data, including names, DoD Benefits numbers, and ZIP codes. Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Attack Vector You can skip this ad in 5 seconds