Estée Lauder Says Hackers Stole Staff Data Through an Oracle HR System Flaw

Key points

• Estée Lauder has told affected people that hackers broke into its Oracle E-Business Suite HR system on or around August 9, 2025.
• The company confirmed the scope of the theft on June 19, 2026, after a months-long investigation.
• Stolen data includes names, Social Security numbers, passport numbers, bank account details, and health and payroll records.
• The timing lines up with mass exploitation of CVE-2025-61882, a flaw in Oracle's business software patched on October 4, 2025.
• Estée Lauder is offering 24 months of free identity monitoring through Kroll.

Estée Lauder is writing to customers and staff to tell them their personal information was stolen in a break-in last summer.

The cosmetics company, which employs around 57,000 people and reported $14.3 billion in annual revenue, said hackers got into its Oracle E-Business Suite system on or around August 9, 2025. Oracle E-Business Suite is a large piece of back-office software that many big companies use to run human resources and payroll. Estée Lauder used it for HR.

The company said it completed its investigation on June 19, 2026. By then, the intruders had already made off with a serious amount of personal data.

What information was taken?

The stolen files include full names, home addresses, email addresses, birth dates, Social Security numbers, passport numbers, financial account details, health information, and employment records covering payroll and performance reviews.

That's close to a worst-case list. Passport and Social Security numbers are exactly what criminals use to open credit lines or file fake tax returns in someone else's name.

Kroll is handling two years of identity monitoring for affected people, who are being told to watch their accounts for signs of fraud.

How did the hackers get in?

Estée Lauder hasn't named the specific flaw, but the date of the break-in matches a well-documented attack campaign against Oracle E-Business Suite.

The bug is tracked as CVE-2025-61882. It let attackers reach the Oracle system over the internet, skip the login step entirely, and run their own commands on the server, giving them access to whatever HR and finance data the system held. The flaw affected E-Business Suite versions 12.2.3 through 12.2.14. Oracle shipped a fix on October 4, 2025. By then, the damage was already spreading.

Google's Mandiant team and CrowdStrike later tied the attacks to Clop, a long-running extortion crew that specialises in hitting one widely used piece of enterprise software at a time and draining data from every customer it can reach. Clop had been quietly exploiting the Oracle bug since early August 2025, before Oracle knew it existed. A flaw with no available patch when attacks begin is called a zero-day.

This was, as first reported by BleepingComputer, a broad campaign. Confirmed victims include Harvard, Dartmouth, the University of Pennsylvania, the University of Phoenix, The Washington Post, Logitech, GlobalLogic, Cox Enterprises, and American Airlines subsidiary Envoy Air.

Would multi-factor authentication have helped?

Honestly, not much here. The Oracle flaw let attackers bypass the login process entirely through the BI Publisher Integration component, a reporting tool bolted onto E-Business Suite. Multi-factor authentication, which requires a phone-generated code on top of a password, only helps when the attacker actually has to log in. This attack didn't need a password at all.

Faster patching, tighter network rules on which machines can reach the HR server, and monitoring for the specific web requests the attackers used would all have made a difference.

This isn't Estée Lauder's first encounter with Clop. The same gang hit the company in 2023 through a different zero-day, that time in the MOVEit file-transfer product. Two zero-days, two years apart, same attackers. That pattern should concentrate minds in the company's security team, and in any enterprise still treating patch cycles as a quarterly admin task rather than an active defence.