Estee Lauder discloses breach via Oracle EBS zero-day
Estee Lauder says hackers broke into its Oracle E-Business Suite HR system around August 9, 2025 by exploiting a flaw in the software. The company only confirmed the scope of the theft on June 19, 2026 and began notifying affected people in July 2026. Stolen data includes personal, financial and health information, and the breach is part of a wider wave of attacks hitting organizations that ran the same vulnerable Oracle system.
- Started
- Aug 9, 2025
- Latest activity
- Jul 22, 2026
- Attributed to
- Not confirmedNo credible attribution yet
- Where
- United States
- Sectors
- Retail, Consumers
- Scale
- Estee Lauder current and former employees, and reportedly some customer records
Current status
On July 22, 2026, ThaiCERT reported that notification letters and identity monitoring were underway, with no closure announced.
Dormant: No new confirmed activity for a while, and nobody has called an official all clear.
Impact
Attackers exfiltrated personal, financial and health information from Estee Lauder's Oracle E-Business Suite HR system; the company says it took nearly a year to confirm and disclose the theft.
What to do
Estee Lauder employees or former employees who receive a notification letter should follow its instructions and watch for identity theft or phishing attempts using the stolen data.
Timeline
-
Sep 5, 2026
No new confirmed activity reported, so this incident moved to dormant while it stays open.
Dormant -
Jul 22, 2026
ThaiCERT said the breach timing matched the Oracle E-Business Suite attacks linked to the Clop crime group, but Estee Lauder had not named the attacker.
Containedthaicert.or.th -
Jul 21, 2026
SecurityWeek reported the stolen data included personal, financial and health information.
Containedsecurityweek.com -
Jun 30, 2026
Estee Lauder began notifying employees of the data breach tied to the Oracle E-Business Suite flaw.
Containedbleepingcomputer.com -
Jun 19, 2026
Estee Lauder confirmed the scope of the data theft after an internal investigation.
Activethecyberexpress.com -
Aug 9, 2025
Attackers gained unauthorized access to Estee Lauder's Oracle E-Business Suite system.
Emergingsecurityweek.com
Sources
- Estée Lauder discloses data breach via Oracle E-Business flaw BleepingComputer Jun 30, 2026
- Estée Lauder Discloses Impact From Oracle EBS Zero-Day Hack SecurityWeek Jul 21, 2026
- Estée Lauder data breach exposes personal info The Cyber Express Jul 15, 2026
- Estee Lauder customer data stolen via Oracle EBS flaw SC World Jul 1, 2026
- CISA orders feds to patch actively exploited Oracle flaw BleepingComputer Jul 16, 2026
- Estee Lauder Discloses Data Breach After Oracle E-Business Suite Exploited in Attack ThaiCERT Jul 22, 2026
Related reports
- Estée Lauder hack steals customer data Jul 21, 2026
- Oracle E-Business Suite zero-day under attack Jul 16, 2026
- Oracle E-Business Suite file transfer flaw under attack Jul 15, 2026
- Estée Lauder data breach exposes personal info Jul 15, 2026
- Estee Lauder customer data stolen via Oracle EBS flaw Jul 1, 2026
- Estée Lauder data breach from Oracle HR flaw Jun 30, 2026