The cosmetics giant Estée Lauder is notifying staff of a data breach after hackers slipped into the Oracle software it uses to run human resources. BleepingComputer first reported the disclosure.
Nearly a year in the dark
The timeline is the uncomfortable part. According to the company’s notification letter, an intruder reached its Oracle E-Business Suite system on or around 9 August 2025. Estée Lauder says it only confirmed the theft on 19 June 2026. The letters went out on 17 July. That is close to a year of exposure.
The haul is broad. The stolen records include full names, postal and email addresses, dates of birth, social-security numbers, passport numbers, bank account details, health information, and employment data such as payroll and performance reviews. The company is offering affected staff two years of free identity monitoring through Kroll.
One flaw, a hundred victims
