Estée Lauder Discloses Oracle E-Business Suite Breach

Cosmetics giant Estée Lauder is notifying current and former employees that their sensitive personal and employment data was stolen in a cybersecurity breach that occurred nearly a year ago. The company confirmed the intrusion targeted its Oracle E-Business Suite system, which it uses for human resources management, on or around August 9, 2025.

According to notification letters sent to affected individuals, the company's investigation determined on June 19, 2026, that an unauthorized party had accessed the system and obtained a wide array of personal information. The compromised data includes full names, postal and email addresses, dates of birth, Social Security numbers, passport numbers, bank account details, health information, and extensive employment records such as payroll history and performance reviews.

Estée Lauder stated it has engaged outside cybersecurity experts, notified law enforcement, and implemented additional safeguards to protect its systems. The company is offering affected individuals 24 months of complimentary identity monitoring services through Kroll and is advising them to remain vigilant for signs of identity theft and fraud.