# Estée Lauder Faces Data Breach Linked to Oracle EBS Vulnerability

*Published July 26, 2026*
*Source: [https://www.securityweek.com/estee-lauder-discloses-impact-from-oracle-ebs-zero-day-hack/](https://www.securityweek.com/estee-lauder-discloses-impact-from-oracle-ebs-zero-day-hack/)*

## Executive Summary

Estée Lauder is addressing a data breach stemming from an Oracle E-Business Suite vulnerability exploited by the Cl0p group, affecting sensitive employee information. The company is enhancing its security measures and offering identity protection services to those impacted.

## Article

Estée Lauder, a leading cosmetics company, is in the process of notifying its employees about a significant data breach that occurred last year. This breach exploited a zero-day vulnerability in Oracle's E-Business Suite, identified as CVE-2025-61882, which allowed unauthorized remote code execution. The breach was initiated by the notorious Cl0p cybercrime group in early August 2025. This vulnerability facilitated the exfiltration of sensitive information from multiple organizations.

In March 2026, Estée Lauder was among the last major firms to disclose the impact of this cyberattack, following reports that Cl0p had released 870GB of archived data allegedly taken from the company. The compromised data included personal information such as names, addresses, dates of birth, Social Security numbers, and sensitive employment-related data. The company has assured affected individuals of 24 months of free identity monitoring services and has urged them to be cautious about any suspicious communications.

Estée Lauder has reported this incident to law enforcement and is actively working to bolster its cybersecurity measures. Although the exact number of affected individuals remains undisclosed, the company is committed to transparency and protection as it navigates this breach. SecurityWeek has reached out for further details and will provide updates as they become available.