Estée Lauder reports breach involving Oracle E-Business Suite HR system
Summary
Estée Lauder says an unauthorized party accessed its Oracle E-Business Suite HR system on August 9, 2025, and obtained personal information. The company is offering 24 months of identity monitoring.
Key points
- Estée Lauder says it determined on June 19, 2026, that an unauthorized party had accessed its Oracle E-Business Suite HR system on or around August 9, 2025.
- The disclosed information included names, addresses, email addresses, dates of birth, Social Security and passport numbers, financial account details, health information, and employment records.
- The company did not identify the vulnerability exploited in its incident.
- The breach date correlates with the Clop campaign targeting Oracle E-Business Suite through CVE-2025-61882, but the article does not confirm that vulnerability was used against Estée Lauder.
- Estée Lauder is offering recipients 24 months of complimentary identity monitoring through Kroll.
Article Details
- Victim Organization
- Estée Lauder
- Incident Type
- Data breach involving unauthorized access to the Oracle E-Business Suite HR system and acquisition of personal information. The company confirmed the breach but did not identify the vulnerability exploited.
- Incident Date
- 2025-08-09
- Data Types Exposed
- Full names
- Postal addresses
- Email addresses
- Dates of birth
- Social Security numbers
- Passport numbers
- Financial account information, including bank account numbers
- Health information
- Employment information, including payroll and performance reports
- Affected Records
- Certain individuals; exact number not disclosed.
- Affected Data Size
- Unknown
- Operational Impact
- Unauthorized access to the HR system and acquisition of personal information were confirmed. No operational disruption was reported. Estée Lauder offered 24 months of identity monitoring through Kroll.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed