This incident involves a data breach at Estée Lauder caused by exploitation of CVE-2025-61882, a critical vulnerability in Oracle E-Business Suite versions 12.2.3 through 12.2.14. The flaw allows attackers to bypass authentication and execute code remotely through the BI Publisher Integration component, compromising sensitive HR and business data. The breach was identified in June 2026 but occurred in August 2025, coinciding with a known mass exploitation campaign by the Clop ransomware group. Oracle issued an official patch on October 4, 2025. The breach exposed extensive personal information including social security numbers, passport numbers, financial and health information. Estée Lauder has notified affected individuals and is providing complimentary identity monitoring services.

The breach resulted in unauthorized access to sensitive personal data of individuals, including full names, postal addresses, email addresses, dates of birth, social security numbers, passport numbers, financial account details, health information, and employment records. This exposure increases the risk of identity theft and fraud for affected individuals. The vulnerability exploited allows remote code execution and authentication bypass, potentially compromising the confidentiality and integrity of HR and business systems. The incident is part of a broader exploitation campaign affecting multiple high-profile organizations.

Oracle released an official patch for CVE-2025-61882 on October 4, 2025, which addresses the authentication bypass and remote code execution vulnerability in Oracle E-Business Suite versions 12.2.3 through 12.2.14. Organizations using affected versions should apply this patch immediately if not already done. Estée Lauder is advising affected individuals to monitor for identity theft and fraud and is providing 24 months of complimentary identity monitoring services. No additional mitigation guidance is provided by the vendor advisory. Patch status is confirmed as fixed by Oracle's official update.