Loading story…
Estée Lauder disclosed that attackers breached its Oracle E-Business Suite environment used for human resources operations and stole personal information from certain individuals. The company said unauthorized access occurred on or around August 9, 2025, and was confirmed through an investigation on June 19, 2026. Exposed data varied by person but included highly sensitive records such as Social Security numbers, passport numbers, bank account details, health information, and employment data.
The intrusion aligns with the wider exploitation of Oracle E-Business Suite zero-day CVE-2025-61882, a remote code execution flaw later tied by Google and Mandiant to the Cl0p extortion gang. Oracle released fixes on October 4, 2025, after multiple organizations were reportedly affected in the same campaign. Estée Lauder said it brought in external cybersecurity experts, notified law enforcement, added safeguards, and is offering affected individuals 24 months of identity monitoring through Kroll while warning them to watch for identity theft and fraud.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Estée Lauder disclosed the data breach and said it is notifying affected individuals whose information was exposed. The company is urging vigilance for identity theft and fraud and offering 24 months of identity monitoring through Kroll.
Estée Lauder said its investigation confirmed on June 19, 2026 that personal information had been stolen from its Oracle E-Business Suite environment. The company also said it engaged outside cybersecurity experts, notified law enforcement, and added safeguards after discovering the incident.
Oracle released patches for the Oracle E-Business Suite vulnerability CVE-2025-61882 after broader exploitation of the flaw, which reporting linked to a campaign later associated with the Cl0p extortion gang.
Estée Lauder said an unauthorized third party accessed its Oracle E-Business Suite environment used for HR operations on or around August 9, 2025, and stole personal information from certain individuals.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityweek.com
Open sourcehelpnetsecurity.com
Open sourceteiss.co.uk
Open sourcebleepingcomputer.com
Open sourceoag.ca.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Bimbo Bakeries USA confirmed that attackers stole employee information from an Oracle E-Business Suite environment operated by a third-party vendor. The company identified unauthorized file acquisition on December 6, 2025, and determined on August 19, 2026, that a stolen file contained employees’ names and Social Security numbers; it has not disclosed the number of people affected. The intrusion aligns with the campaign exploiting `CVE-2025-61882`, a critical unauthenticated remote-code-execution vulnerability in Oracle EBS that has been linked by researchers to the Clop extortion group, although Bimbo has not attributed the incident to Clop or confirmed an extortion demand. Bimbo said it applied Oracle’s emergency patches, is reassessing vendor relationships, and is providing 12 months of credit monitoring and fraud-assistance services to affected individuals.
Sep 7, 2026
Oracle E-Business Suite (EBS) was found to contain a critical zero-day vulnerability, tracked as CVE-2025-61884 and CVE-2025-61882, which allowed unauthenticated remote code execution and was actively exploited by threat actors, including the Clop ransomware group. The vulnerability, present in EBS versions 12.2.3 through 12.2.14, enabled attackers to access sensitive resources without authentication by exploiting a pre-authentication Server-Side Request Forgery (SSRF) flaw. Oracle released an out-of-band security update to address the issue, but did so without publicly acknowledging that the flaw was being actively exploited or that a proof-of-concept exploit had been leaked by the ShinyHunters extortion group. Security researchers and customers confirmed that the patch addressed the SSRF vulnerability used in the attacks. The exploit chain was complex, involving an unauthenticated HTTP POST to a specific servlet, manipulation of return_url parameters to trigger SSRF, CRLF/header injection, HTTP connection reuse, and ultimately the delivery of a malicious XSL stylesheet. This XSLT payload, containing embedded Java code, was processed by the server, leading to arbitrary code execution and the potential for attackers to spawn reverse shells. The Clop ransomware group sent extortion emails to Oracle EBS customers, claiming to have stolen sensitive data by exploiting this flaw, and confirmed their involvement in the campaign. The attack campaign was detected by Mandiant and Google, who observed that multiple threat actors were leveraging the vulnerability for data theft and extortion. The exploit chain demonstrated the risk of chaining multiple weaknesses in enterprise software to achieve full remote code execution. Security vendors, such as Imperva, responded by confirming protection for their customers against this exploit. The incident highlighted Oracle's lack of transparency regarding active exploitation and the public availability of exploit code. The technical details of the exploit, including SSRF, CRLF injection, and XSLT-based code execution, underscored the sophistication of the attack. The vulnerability's exploitation in the wild emphasized the importance of rapid patching and monitoring for signs of compromise in Oracle EBS environments. The campaign also illustrated the ongoing threat posed by ransomware and extortion groups targeting critical business applications. Organizations using Oracle EBS were urged to apply the security update immediately and review their systems for indicators of compromise. The incident raised concerns about the security of widely used enterprise resource planning (ERP) platforms and the need for proactive vulnerability management.
Jun 29, 2026
Oracle has confirmed that its customers are being targeted by data-stealing extortionists who are demanding ransoms in exchange for not leaking stolen data. The attackers are specifically focusing on organizations using Oracle E-Business Suite (EBS), with multiple cybersecurity firms reporting that executives at these organizations have received ransom emails demanding up to $50 million. Oracle has stated that, based on its ongoing investigation, there is no evidence that a zero-day vulnerability is being exploited in these attacks. Instead, the attackers appear to be leveraging previously identified vulnerabilities that were addressed in Oracle's July 2025 critical patch update. Of the 309 security patches issued in that update, nine were for Oracle EBS, with three of those vulnerabilities being remotely exploitable without authentication. The attackers are believed to be gaining access through internet-facing Oracle EBS portals, particularly by targeting local accounts that lack multifactor authentication (MFA), thereby bypassing enterprise single sign-on controls. Cybersecurity firm Halcyon highlighted that the absence of MFA on these accounts is a key factor enabling the attackers to compromise systems. Oracle has strongly reiterated its recommendation that all customers apply the latest critical patch updates to mitigate these risks. The extortion campaign has caused significant concern among Oracle EBS users, as the attackers claim to have accessed sensitive data and are threatening to leak it unless their demands are met. The campaign underscores the importance of timely patch management and the implementation of robust authentication controls, especially for systems exposed to the internet. Security experts warn that organizations failing to update their Oracle EBS installations remain at heightened risk of compromise. The incident has also prompted renewed calls for organizations to review their security posture, particularly regarding privileged account management and the enforcement of MFA. While Oracle continues to investigate the full scope of the campaign, the company maintains that customers who have applied the July 2025 patches are protected against the vulnerabilities being exploited. The situation highlights the ongoing threat posed by extortion-focused cybercriminals and the critical need for organizations to maintain up-to-date security measures. The campaign has also drawn attention to the broader issue of patch adoption lag, as many organizations continue to use outdated software versions despite available fixes. Oracle's response has included direct communication with affected customers and public advisories emphasizing the urgency of patching. The extortion emails and the technical details of the attack have been corroborated by multiple cybersecurity research firms, lending credibility to the reported tactics. The incident serves as a stark reminder of the evolving tactics of cyber extortionists and the persistent risks facing organizations that delay critical security updates.
Jun 29, 2026