Cosmetics Giant, Estee Lauder, Hit in Third-Party Attack
As a result of a third-party issue, New York, New York-based cosmetics giant, Estee Lauder Companies, suffered a cyberattack in August of last year and is now letting victims know their personally identifiable information ended up stolen in the hack.
“We became aware of a cybersecurity issue involving a vulnerability in the Oracle E-Business Suite system which is used by the Estee Lauder Companies for HR management purposes,” the company said in a letter to victims. “On June 19, 2026, we determined through our investigation that, on or around August 9, 2025, an unauthorized third party gained access to the Oracle E-Business Suite system and obtained personal information of certain individuals.”
The affected information included names, postal and email addresses, dates of birth, Social Security numbers, passport numbers, financial account information (bank account numbers), health information, and employment-related information (such as performance evaluation and payroll information). The impacted data varied for each affected individual.