Estée Lauder was compromised in August 2025 through exploitation of CVE-2025-61882, a zero-day vulnerability in Oracle E-Business Suite that enabled unauthenticated remote code execution. The Cl0p cybercrime group used this vulnerability to exfiltrate approximately 870GB of sensitive data from multiple companies, including Estée Lauder. The stolen data involved extensive personal and financial information of employees managed within the Oracle EBS HR system. The vulnerability was patched in early October 2025, with CrowdStrike confirming exploitation began on the same day as the initial breach. Estée Lauder has disclosed the breach publicly in July 2026, providing affected individuals with identity monitoring and enhancing system security.

The breach resulted in unauthorized access and exfiltration of sensitive personal, financial, and health information of Estée Lauder employees. This includes highly sensitive data such as Social Security numbers, passport numbers, bank account details, and payroll information, which could lead to identity theft, financial fraud, and privacy violations. The incident affects the confidentiality of employee data managed within Oracle EBS. No direct evidence of further exploitation beyond data theft has been reported.

A patch for the zero-day vulnerability CVE-2025-61882 in Oracle EBS was released in early October 2025. Organizations using Oracle EBS should ensure that this patch is applied promptly. Estée Lauder has already implemented system protection improvements and notified law enforcement. Affected individuals are being offered identity monitoring services. No further immediate action is required beyond applying the official patch and monitoring for suspicious activity related to compromised data.