Estée Lauder Notifies Employees Following Oracle E-Business Data Breach

THE WHAT? The Estée Lauder Companies has disclosed that employee data was compromised following a cyberattack targeting Oracle’s E-Business Suite (EBS), prompting the company to notify current and former employees whose information may have been affected.

THE DETAILS The company said an unauthorised third party gained access to its Oracle EBS system in August 2025, exposing personal information including names, contact details, dates of birth, Social Security numbers, passport information, bank details, health records and internal HR data. Estée Lauder launched an investigation with external cybersecurity specialists, notified law enforcement and implemented additional security measures. The breach is believed to be linked to a wider campaign exploiting vulnerabilities in Oracle EBS, reportedly associated with the Cl0p ransomware group, although Estée Lauder has not confirmed the identity of the attackers. The company is offering affected employees identity monitoring and fraud protection services.

THE WHY? The incident highlights the growing cybersecurity risks facing global beauty companies that rely on third-party enterprise software, underlining the importance of supply chain security, rapid incident response and robust protection of sensitive employee and business data.

Source: Computer Weekly