Estée Lauder notified current and former employees of a data breach targeting its Oracle E-Business Suite (EBS) system. An unauthorized third party accessed the system in August 2025.
The breach exposed names, Social Security numbers, and passport details. Compromised information also includes financial and health records.
The company launched an investigation with cybersecurity experts and notified law enforcement. Estée Lauder is now implementing additional security protocols.
The incident likely stems from a broader campaign exploiting Oracle EBS vulnerabilities. Experts potentially link the attack to the Cl0p ransomware group. Affected individuals will receive identity monitoring and fraud protection services.