Estée Lauder discloses data breach via Oracle E-Business flaw

Estée Lauder disclosed that an intrusion on or around August 9, 2025 exploited a flaw in Oracle E-Business Suite (aligned with CVE-2025-61882) to access HR data and obtain sensitive personal information (names, addresses, DOBs, SSNs, passport and bank details, health and employment records); the incident is tied to the Clop mass-exploitation campaign that affected numerous universities and companies and the firm is offering 24 months of identity monitoring.