Estée Lauder customer data compromised in Oracle E-Business Suite breach

As noted by Bleeping Computer, cosmetics giant Estée Lauder is informing customers about a data breach that occurred due to a vulnerability in Oracle's E-Business Suite, which the company utilized for its human resources operations. The intrusion, identified last month, took place on August 9, 2025, leading to the exposure of personal information belonging to certain individuals.

The breach at Estée Lauder, a New York-based cosmetics firm with $14.3 billion in annual revenue, resulted from the exploitation of a vulnerability in Oracle E-Business Suite, specifically impacting versions 12.2.3 through 12.2.14. The flaw, identified as CVE-2025-61882, allowed attackers to bypass authentication and execute remote code, granting access to sensitive HR data. Exposed information includes full names, postal and email addresses, dates of birth, Social Security numbers, passport numbers, financial account details, health information, and employment records.

This incident aligns with a broader campaign targeting Oracle E-Business Suite, with the Clop ransomware gang previously identified as exploiting this zero-day vulnerability. Oracle released patches for the vulnerability on October 4, 2025, after the breach had already occurred. Estée Lauder is offering 24 months of complimentary identity monitoring services to affected individuals and advises vigilance against identity theft and fraud.

Source: Bleeping Computer