Oracle Corp E-Business Suite Exploited in Major Estée Lauder Breach

What happened

On or around August 9, 2025, an unauthorized third party exploited a vulnerability in Oracle E-Business Suite (EBS) to gain access to Estée Lauder's human resources system. The attackers obtained personal information including full names, postal and email addresses, dates of birth, Social Security numbers, passport numbers, and financial account information. Estée Lauder only concluded its investigation on June 19, 2026-nearly ten months after the intrusion-and disclosed the breach publicly on July 20, 2026. The company is now offering 24 months of complimentary identity monitoring through Kroll to affected individuals and urging them to watch for signs of identity theft and fraud.

Why it matters

This incident highlights the risk Oracle's enterprise customers face when critical vulnerabilities in widely deployed software like E-Business Suite are exploited before patches are available. The flaw in question, CVE-2025-61882, allowed attackers to bypass authentication and remotely execute code, making it a severe threat to any organization running Oracle EBS. The Cl0p ransomware gang exploited this vulnerability as a zero-day, stealing data before Oracle released fixes. For Oracle, this breach underscores the importance of rapid vulnerability disclosure, patch deployment, and customer communication. Large-scale exploitation campaigns like this can erode trust in Oracle's enterprise software portfolio and may prompt customers to demand stronger security controls or consider alternative vendors.

Bigger picture

Estée Lauder is one of over 100 organizations reportedly affected by the same Oracle EBS exploitation campaign. Other high-profile victims include Nissan, a Canon subsidiary, Harvard University, the University of Phoenix, The Washington Post, and Logitech. The Cl0p ransomware gang, listed among the top threats in Kela's 2025 Midyear Threat Report, has been responsible for multiple mass-exploitation campaigns targeting enterprise software vulnerabilities. This pattern of coordinated, large-scale attacks on widely used business software platforms poses a significant risk across industries. For Oracle, the widespread impact of this campaign could lead to increased scrutiny from regulators, enterprise customers, and investors regarding the security of its enterprise application suite.

What to watch

Investors should monitor whether Oracle issues further security updates or advisory guidance for E-Business Suite customers, and whether additional organizations disclose breaches tied to CVE-2025-61882. Any class action lawsuits or regulatory actions targeting Oracle or affected customers could also emerge. Watch for Oracle's response in terms of product security enhancements, customer support measures, and any impact on enterprise software sales or renewals. Additionally, keep an eye on whether this incident prompts broader industry discussions about supply chain security and vendor accountability for zero-day vulnerabilities.