Bimbo Bakeries USA Discloses Data Breach Exposing Personal Information Bimbo Bakeries USA, a leading U.S. baking company and subsidiary of global giant Grupo Bimbo, confirmed a data breach stemming from a security flaw in its Oracle platform. The vulnerability allowed unauthorized access to company files, with the exposure first identified on August 19, 2026, and formally reported on August 31, 2026. The breach was initially detected on December 6, 2025, though the full scope of compromised data was only confirmed months later. Among the exposed files, at least one contained sensitive personal information, including a person’s name and Social Security number. The incident has since drawn legal scrutiny, with Edelson Lechtzin LLP, a national class action law firm, launching an investigation into potential claims on behalf of affected individuals. The firm is offering free case evaluations to those who received breach notifications from Bimbo Bakeries USA. The breach raises concerns about identity theft and fraud risks for impacted individuals. While the exact number of affected parties remains unclear, the exposure of Social Security numbers heightens the potential for long-term misuse. Bimbo Bakeries USA has not disclosed further details on the total volume of compromised data or the duration of unauthorized access. The incident underscores ongoing vulnerabilities in enterprise software platforms and the delayed discovery of breaches, even after initial detection. Legal proceedings and further disclosures may provide additional clarity on the full impact.

Bimbo Bakeries USA Confirms Data Breach via Oracle EBS Zero-Day Exploited by Clop Ransomware Gang Bimbo Bakeries USA, the U.S. division of the world’s largest baking company, disclosed a data breach stemming from a zero-day vulnerability in Oracle’s E-Business Suite (EBS). The incident, confirmed in a notification letter filed with the California Attorney General’s office on September 4, 2026, revealed that attackers exploited the flaw to steal employee data through a third-party vendor reliant on Oracle EBS. The breach was traced back to CVE-2025-61882, a critical unauthenticated remote code execution vulnerability (CVSS 9.8) in Oracle EBS’s BI Publisher Integration component. The flaw allowed attackers to execute arbitrary code on unpatched systems without credentials. Exploitation began as early as August 2025, with Oracle releasing an emergency patch on October 4, 2025. Cybersecurity firm Mandiant linked the campaign to the Clop ransomware gang, which targeted multiple Oracle EBS customers, including Harvard University and The Washington Post, in a global extortion spree. Bimbo Bakeries detected the breach on December 6, 2025, after applying Oracle’s patches and launching a forensic investigation. The review concluded on August 19, 2026, confirming that stolen files contained names and Social Security numbers of affected individuals. While the company did not disclose the number of impacted employees or whether it received a ransom demand, it acknowledged reevaluating vendor relationships and offering 12 months of free credit monitoring through Cyberscout. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog following Oracle’s disclosure. Security experts have since urged organizations running affected Oracle EBS versions (12.2.3–12.2.14) to verify patch deployment, audit logs for suspicious activity, and rotate credentials tied to EBS integrations.

The Maine Office of the Attorney General reported a data breach involving Bimbo Bakeries USA, Inc. on June 5, 2024. The breach, which occurred on February 13, 2024, involved an external system breach (hacking) affecting 14 Maine residents' personal information, including names, Social Security numbers, and dates of birth. The affected individuals will receive notification on or about June 6, 2024, with an offer of 24 months of credit monitoring services through Experian.