Summary

• The dominant pattern is a vendor-system breach: Oracle E-Business Suite was used as the entry point into sensitive HR records at Estée Lauder.
• The incident appears to have remained undetected for many months, with access around August 2025 and disclosure in July 2026.
• Exposed data consistently includes direct identifiers and high-risk records such as Social Security numbers, passport numbers, bank details, and some health or payroll information.
• Multiple reports connect the timing to CVE-2025-61882, a high-severity Oracle EBS flaw that was reportedly exploited at scale in 2025.
• Clop is the main threat actor mentioned in connection with the broader Oracle exploitation campaign, though not every report confirms direct attribution for this specific breach.
• Estée Lauder's response is consistent across reports: external investigation, law enforcement notification, and 24 months of identity monitoring through Kroll.
• The topic is coherent and dense, but some factual uncertainty remains around the exact exploited vulnerability and the degree of confirmed actor attribution for the Estée Lauder incident.