Estée Lauder Discloses Major Data Breach Affecting Sensitive Customer Information Estée Lauder Companies Inc., a global leader in prestige beauty, has reported a data breach that exposed highly sensitive personal information. While the exact number of affected individuals in the U.S. remains undisclosed, the compromised data includes Social Security numbers, financial account details, credit and debit card information, government ID numbers, and health records. Key details of the incident such as the attack method, timeline, and how the breach was detected have not been made public. The company filed a breach notification with the Vermont Attorney General on July 10, 2026. Estée Lauder has indicated that impacted individuals will receive direct notifications in the coming weeks, outlining the nature of the breach, the specific data exposed, and any available resources. The company has also advised recipients to verify the legitimacy of any communications by contacting Estée Lauder directly through its official website rather than relying on unverified sources.

Oracle E-Business Suite Hack Leaves Four Major Companies Silent on Impact A recent cyberattack targeting Oracle E-Business Suite (EBS) has disrupted organizations reliant on the platform for critical business operations, including finance, supply chain, HR, and procurement. While many companies have responded with public disclosures and mitigation efforts, Broadcom, Bechtel, Estée Lauder, and Abbott Technologies have yet to issue any statements, raising concerns about transparency and crisis management. The breach exposes vulnerabilities in a widely used enterprise software suite, threatening the integrity of sensitive corporate and customer data. Security researchers and incident response teams are assessing the full scope of the compromise, with affected organizations working to determine exposure and prevent follow-on attacks. In contrast to the silent four, other companies have taken proactive steps, including acknowledging the breach, implementing security measures, collaborating with cybersecurity firms, and notifying stakeholders. This approach is considered best practice in handling enterprise-wide software vulnerabilities. The continued silence from Broadcom, Bechtel, Estée Lauder, and Abbott Technologies leaves stakeholders uninformed about potential risks, data protection efforts, and the companies’ cybersecurity commitments. The lack of disclosure may also invite regulatory scrutiny, particularly for publicly traded firms, while risking long-term reputational damage. As cybersecurity incidents grow in frequency and severity, transparent communication is increasingly seen as a corporate obligation both for stakeholder trust and legal compliance. The absence of updates from these four companies underscores a critical gap in modern incident response policies.

Broadcom, a global technology leader valued at hundreds of billions, was among the high-profile victims of Cl0p’s ransomware attack exploiting a zero-day vulnerability in Oracle’s E-Business Suite (CVE-2025-61882 and CVE-2025-21884). The cybercriminal group exfiltrated sensitive corporate and customer data, threatening to leak or sell it unless a ransom was paid. The breach compromised critical systems, risking financial records, proprietary business data, and third-party customer information. Cl0p’s extortion tactics included warnings of public disclosure on their blog, torrent leaks, or sales to malicious actors, amplifying reputational and operational risks. Given Broadcom’s role in semiconductor and infrastructure technology, the attack posed supply chain cascading risks, potentially disrupting clients reliant on its products. Oracle issued emergency patches, but the damage—including data theft, potential regulatory fines, and erosion of stakeholder trust—had already occurred. The incident underscores vulnerabilities in enterprise software dependencies, with Broadcom facing long-term financial and strategic repercussions if the stolen data is weaponized.

The Washington State Office of the Attorney General reported that The Estée Lauder Companies Inc. experienced a cyberattack on July 11, 2023, affecting approximately 150,535 Washington residents. The breach involved unauthorized access to personal information, including names, dates of birth, email addresses, and passwords, with the notification made on August 31, 2023.

The Maine Office of the Attorney General reported a data breach involving The Estée Lauder Companies Inc. on October 19, 2023. The breach occurred between May 30 and June 1, 2023, due to an external system breach affecting files transferred through Progress Software's MOVEit Transfer, compromising the driver's license number and Social Security number of 3 individuals, including 1 resident of Maine.