The Estée Lauder data breach has prompted the global cosmetics company to notify affected individuals after hackers exploited a vulnerability in Oracle E-Business Suite, a platform used for human resources (HR) operations. The Estée Lauder cyberattack stemmed from unauthorized access that occurred on or around August 9, 2025, though the company said it identified the incident last month and confirmed the scope of the breach on June 19, 2026.
Estée Lauder Data Breach Exposed Sensitive Personal Information
According to the company's notification letter, the attackers gained access to the Oracle E-Business Suite system and obtained personal information belonging to certain individuals.We became aware of a cybersecurity issue involving a vulnerability in the Oracle E-Business Suite system which is used by the Estee Lauder Companies for HR management purposes," the notice states.It further adds: "On June 19, 2026, we determined through our investigation that, on or around August 9, 2025, an unauthorized third party gained access to the Oracle E-Business Suite system and obtained personal information of certain individuals."The exposed data in the incident includes full names, postal addresses, email addresses, dates of birth, Social Security numbers (SSNs), passport numbers, financial account information, including bank account numbers, health information, and employment records such as payroll and performance reports.
Oracle Vulnerability Tied to Estée Lauder Cyberattack
Although Estée Lauder did not identify the specific vulnerability used in the attack, the timeline aligns with the widespread exploitation of the Oracle E-Business Suite flaw CVE-2025-61882.In October 2025, researchers from Google warned that the Clop ransomware group had exploited the vulnerability as a zero-day to steal data. The flaw affected Oracle EBS versions 12.2.3 through 12.2.14, allowing attackers to bypass authentication and remotely execute code through the BI Publisher Integration component. Successful exploitation could provide access to sensitive HR and business information.Oracle released security patches for CVE-2025-61882 on October 4, 2025. Soon after, cybersecurity company CrowdStrike confirmed that Clop had been exploiting the vulnerability since early August 2025.
Company Offers Identity Monitoring
Estée Lauder, headquartered in New York, generates annual revenue of $14.3 billion, employs around 57,000 people, and operates retail stores and online businesses worldwide, making it the world's second-largest cosmetics company.Following the Estée Lauder data breach, the company is urging recipients of its notification letter to monitor for signs of identity theft and fraud. It is also providing 24 months of complimentary identity monitoring services through Kroll.The Estée Lauder cyberattack is part of a broader campaign that affected several high-profile organizations, including Harvard, the University of Pennsylvania, Dartmouth, the University of Phoenix, The Washington Post, Logitech, GlobalLogic, Cox Enterprises, and American Airlines subsidiary Envoy Air.This is not the first time the company has been impacted by Clop. In 2023, Estée Lauder was also compromised after the ransomware group exploited a separate zero-day vulnerability in the MOVEit Transfer platform, one of the company's internal software tools.
Craneware plc has disclosed a Craneware data breach after detecting unauthorized access to a portion of its data environment. The company confirmed on 20 July 2026 that it is investigating the incident with the support of external cybersecurity and forensic experts.Although the cyberattack on Craneware resulted in data being viewed and exfiltrated, the company said the incident has been contained and has not disrupted customer services or business operations.
According to the company's official notice, the Craneware cyberattack prompted the activation of its incident response plan immediately after the unauthorized access was identified. The Board appointed external cybersecurity and forensic specialists, who are working alongside Craneware's internal IT team and retained security providers to determine the full scope of the incident.The company stated that investigators have found no remaining indicators of compromise within its systems. Despite the data breach at Craneware, normal operations have continued without interruption.
Data Breach at Craneware Exposed Employee and Customer Records
Initial findings indicate that attackers viewed and exfiltrated a significant volume of file names. Craneware's current assessment suggests that much of the affected information consists of non-sensitive or publicly available regulatory data. However, the investigation has also confirmed that a percentage of employee data, along with a subset of customer and partner records, was accessed and exfiltrated during the Craneware data breach.The organization is continuing to examine the precise nature and extent of the compromised data. It is also working with advisers to identify affected individuals and organizations, prepare notifications where necessary, and meet all applicable regulatory obligations. Craneware added that it will provide further updates to the market as additional information becomes available.As part of its response to the data breach at Craneware, the company has notified relevant regulators and law enforcement agencies. These include the UK's Information Commissioner's Office (ICO) and the US Federal Bureau of Investigation (FBI).
Craneware to Notify Affected Parties as Assessment Continues
In its official announcement, Craneware said: "The incident has been contained, and there has been no disruption to customer services or to the Company's operations. The external specialists have confirmed that there are no residual indicators of compromise arising from the cybersecurity incident in the Company's systems."The company further stated: "Investigations so far have established that a significant volume of file names were viewed and exfiltrated. The current assessment is that a large element of the data involved is non-sensitive or already public regulatory data. A percentage of Craneware employee data as well as a subset of customer and partner records, have been accessed and exfiltrated."The notice also stated: "This announcement contains inside information as stipulated under the UK version of the Market Abuse Regulation No 596/2014, which is part of English Law by virtue of the European (Withdrawal) Act 2018, as amended. On publication of this announcement via a Regulatory Information Service, this information is considered to be in the public domain."While the investigation into the cyberattack on Craneware remains ongoing, the company said it will continue assessing the impact of the cyberattack and issue further updates as appropriate.
Login
