Estée Lauder Reports Data Breach Via Oracle E-Business Flaw

Estée Lauder Companies Inc. is notifying its customers about a data breach that occurred after unauthorized actors exploited a vulnerability in Oracle E-Business Suite. The cosmetics giant utilized this Oracle product for its human resources operations, and the breach exposed sensitive employee and customer information. The company disclosed the incident on May 17, 2024, in a filing with the U.S. Securities and Exchange Commission (SEC).

Hackers gained access to Estée Lauder's systems by exploiting a zero-day vulnerability within the Oracle E-Business Suite. This specific flaw allowed them to access and exfiltrate data. While the full scope of the breach is still under investigation, initial reports indicate that personal information, including names, addresses, and potentially Social Security numbers, may have been compromised. The company stated that it is working with cybersecurity experts to investigate the incident and implement enhanced security measures.

In response to the breach, Estée Lauder has begun notifying affected individuals and is offering identity theft protection services. The company has also reported the incident to relevant regulatory authorities. The breach highlights the ongoing risks associated with third-party software vulnerabilities, particularly in critical HR systems that handle a wealth of personal data. Estée Lauder's reliance on Oracle E-Business Suite for HR functions made it a target for cybercriminals seeking to exploit known or unknown weaknesses in the software.

This incident underscores the importance of robust cybersecurity practices, including regular patching and vulnerability management, for all organizations. The exploitation of a zero-day vulnerability in a widely used enterprise resource planning (ERP) system like Oracle E-Business Suite can have significant consequences, affecting not only the targeted company but also its employees and customers. Estée Lauder's proactive disclosure aims to inform stakeholders and mitigate potential harm.