Estée Lauder says attackers took personal data from its Oracle HR system

Estée Lauder is notifying people that personal information was stolen after attackers reached the Oracle E-Business Suite environment it uses for human resources. The company says an unauthorized third party gained access on or around August 9, 2025, and that it confirmed on June 19, 2026 that personal information had been taken, a gap of more than ten months between intrusion and confirmation. The notice does not name the vulnerability exploited, though the timing lines up with the mass exploitation campaign against Oracle E-Business Suite that ran through last year. Affected people are being offered two years of identity monitoring.

Check

Organizations running Oracle E-Business Suite should confirm the environment is patched against last year's exploited flaws and review access logs from that period, since intrusions there went undetected for months.

Affected

People whose personal information sat in Estée Lauder's Oracle E-Business Suite human resources environment; the data was taken in 2025 and only confirmed in June 2026, leaving a long window for misuse.

Fix

Affected people should enroll in the offered monitoring and consider a credit freeze. Organizations should patch and segment enterprise resource platforms, limit the personal data they hold, and monitor for unusual access.