COSMETICS company Estée Lauder has notified employees about a data breach involving their personal information, which was stolen in August 2025 due to a vulnerability in Oracle E-Business Suite (EBS) exploited by the Cl0p cybercrime group. The breach leaked approximately 870GB of data, including sensitive information such as Social Security numbers, bank account details, and health information.
Estée Lauder is offering 24 months of free identity monitoring to affected individuals and has reported the incident to law enforcement. The company has not disclosed the total number of impacted individuals.