Estée Lauder Discloses Cl0p Oracle EBS Breach — SSNs, Passports, Health Data Exposed Nearly 11 Months After Intrusion

Estée Lauder publicly disclosed a breach stemming from Cl0p ransomware group's zero-day exploitation of CVE-2025-61882 in Oracle E-Business Suite, with the intrusion occurring on or around August 9, 2025 — nearly 11 months before victim notification. Exposed data includes Social Security numbers, passport numbers, financial account codes, and health records belonging to current and former employees. The breach joins a confirmed list of 100+ Cl0p victims in the same Oracle EBS campaign, which also impacted Nissan, Harvard University, The Washington Post, and American Airlines subsidiary Envoy Air.

The breach joins a confirmed list of 100+ Cl0p victims in the same Oracle EBS campaign, which also impacted Nissan, Harvard University, The Washington Post, and American Airlines subsidiary Envoy Air.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.