Washington Post Oracle E-Suite Breach Exposes Data of Over 9,000 Staff and Contractors

The Washington Post disclosed a significant data breach affecting more than 9,700 employees and contractors after an external system compromise targeting its Oracle E-Suite infrastructure. The breach occurred on 10 July 2025 and went undetected for roughly 3.5 months before being discovered on 27 October 2025.

According to breach notifications filed with Maine regulators, the incident impacted 9,720 individuals in total, including 31 Maine residents, with compromised data including names and personal identifiers and additional sensitive information. The Washington Post confirmed that the unauthorized access stemmed from external hacking activity targeting its Oracle E-Suite systems, and notifications were sent to affected individuals on 12 November 2025 after mandatory procedures.

The organisation engaged outside counsel from ZwillGen PLLC to handle regulatory notifications and breach response, with Senior Legal Director Marci Rozen submitting the formal notice on behalf of the Post. In response, The Washington Post arranged 12 months of complimentary identity protection services from IDX for those affected.