Nearly a year after the Cl0p extortion gang began mass-exploiting a critical Oracle E-Business Suite flaw, the victim list is still growing. Estee Lauder disclosed on July 21, 2026 that an intruder used the same vulnerability to pull employee Social Security numbers, passport data, and payroll records from its HR system, a breach the company says actually happened in August 2025 and only surfaced during an internal review in June 2026. The lag illustrates a pattern security leaders now have to plan around: a single unpatched enterprise application can keep generating new breach notices for a year or longer after the intrusion itself.
What Estee Lauder Disclosed
Estee Lauder told affected individuals that an unauthorized party accessed its Oracle E-Business Suite system, used for HR operations, around August 9, 2025. The company says it did not determine the access had occurred until June 19, 2026, and reported the incident to regulators on July 10, 2026, before issuing consumer notifications on July 20. The exposed data set is broad: full names, postal and email addresses, dates of birth, Social Security numbers, passport numbers, bank account numbers, health information, and employment records including performance evaluations and payroll history.
Estee Lauder says it has engaged outside cybersecurity specialists, notified law enforcement, added safeguards to the affected system, and is offering 24 months of complimentary identity monitoring through Kroll, with an enrollment deadline of October 31, 2026.
The Vulnerability Behind the Wave
The flaw is CVE-2025-61882, a critical defect in the Concurrent Processing component of Oracle E-Business Suite, reachable through the BI Publisher Integration feature. Oracle’s own advisory rates it 9.8 on the CVSS 3.1 scale: network-exploitable, low attack complexity, no authentication required, and full impact on confidentiality, integrity, and availability. In practice, that means an attacker with network access to a vulnerable EBS instance could remotely execute code without ever logging in. Oracle’s advisory covers E-Business Suite versions 12.2.3 through 12.2.14 and instructs customers to apply the Security Alert updates as soon as possible, on top of the October 2023 Critical Patch Update baseline.
Google and Mandiant researchers, alongside CrowdStrike, traced active exploitation of this and related EBS flaws back to Cl0p starting in early August 2025, before Oracle had shipped a fix. Oracle released patches on October 4, 2025, roughly two months after the exploitation window Estee Lauder describes.
Why This Class of Flaw Is Different
Unauthenticated remote code execution in an ERP platform is a different class of risk than a typical web application bug. Oracle E-Business Suite sits underneath payroll, HR records, procurement, and often finance workflows, and it is frequently reachable from internal networks with far looser segmentation than a customer-facing application would get. A flaw in the BI Publisher Integration component, which generates reports by pulling data across EBS modules, gives an attacker a path that touches many of those data sets at once rather than a single narrow record type. That combination, broad data access plus a low bar to exploit, is what made this vulnerability attractive enough for a financially motivated group to weaponize before a patch existed.
A Campaign With a Growing Victim List
Estee Lauder is not an isolated case. The same Cl0p campaign against Oracle E-Business Suite has already produced confirmed victims across higher education, media, logistics, and travel, and CyberTech has separately covered a parallel wave of Oracle enterprise-application breaches tied to a different zero-day and threat actor. Two zero-day campaigns against the same vendor’s enterprise application suite, disclosed months apart, point to the same underlying problem: large ERP and HR platforms are high-value, high-blast-radius targets, and their patch cycles are slow relative to how fast a motivated extortion crew moves once a working exploit exists.
What makes the Estee Lauder disclosure notable is the timeline, not the mechanism. Nearly eleven months separate the intrusion from the company’s own confirmation of it, and organizations running EBS on the affected version range may still be working through their own forensic reviews without knowing it yet.
What It Means for the Security Leader
A patched CVE does not close an incident if the exploitation happened before the patch existed. Security leaders who run Oracle E-Business Suite, or any similarly deep enterprise application, need retrospective log review as a standing practice after any critical vendor advisory, not just forward-looking patch compliance. The Estee Lauder case also shows why third-party and internal-HR systems deserve the same monitoring rigor as customer-facing infrastructure: the data stolen here (SSNs, passport numbers, bank details, health records) is exactly the category that drives regulatory exposure and identity-theft harm, regardless of whether the system was customer-facing.
Boards and legal teams should also expect the disclosure timeline itself to draw scrutiny. A near-year gap between compromise and confirmation is becoming a recognizable pattern across multiple EBS victims, and regulators are likely to ask why detection took that long.
What Defenders Should Do
Organizations running Oracle E-Business Suite versions 12.2.3 through 12.2.14 should confirm the October 2025 Security Alert patches for CVE-2025-61882 are applied, not just the underlying Critical Patch Update. Given the confirmed exploitation window in mid-to-late 2025, security teams should pull EBS access and BI Publisher Integration logs covering that period and look for anomalous unauthenticated requests, not only recent activity. Any organization that has not already reviewed its EBS estate against the indicators of compromise Oracle and CrowdStrike published should treat that review as overdue, and should scope data-loss assessments around HR and payroll data specifically, since that is what this campaign has consistently targeted.
Beyond the immediate patch check, security teams should treat any internet-reachable EBS instance as a priority for network segmentation review: BI Publisher Integration and Concurrent Processing endpoints do not need to be exposed outside a trusted internal boundary in most deployments, and restricting that exposure closes the exploitation path even for organizations still validating patch coverage. Retention of EBS access logs should also be extended well beyond typical 90-day windows given how long these campaigns can take to surface, since a shorter retention policy would have made Estee Lauder’s own after-the-fact investigation impossible.
