F500 Consumer Brands · Household and Personal Products · Structural / no discrete incident
Estée Lauder
Headline
Two separate major breaches including a very recent 2026 incident is the finding, and cosmetics retail carries a specific additional exposure…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Two separate major breaches including a very recent 2026 incident is the finding, and cosmetics retail carries a specific additional exposure: virtual try-on technology, which produced the BIPA class actions against Ulta and Sephora documented in Retail & Fintech, is brand-supplied as often as retailer-supplied. Estée Lauder also operates numerous brands - MAC, Clinique, La Mer and others - under one parent, so multi-brand loyalty data consolidates.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected for individual consumer accounts, separate from these employee-focused breaches.
Data sharing
TWO SEPARATE MAJOR BREACHES: (1) A VERY RECENT 2026 breach tied to a critical Oracle E-Business Suite vulnerability (CVE-2025-61882): an unauthorized party accessed Estée Lauder's Oracle EBS HR-management system around August 9, 2025 (confirmed via investigation June 19, 2026), exposing affected individuals' (the notice describes 'certain individuals' in an HR-management system and does not expressly say employees) names, addresses, birthdates, Social Security numbers, passport numbers, bank account numbers, HEALTH INFORMATION, and employment records (performance evaluations, payroll history). The notice does not name the attacker; the access date aligns with the broader Oracle EBS exploitation campaign that Google/Mandiant attributed to the CLOP extortion group, which reportedly affected roughly 100 OTHER ORGANIZATIONS through the same Oracle vulnerability, including Harvard University, University of Pennsylvania, Dartmouth, University of Phoenix, The Washington Post, Logitech, GlobalLogic, Cox Enterprises, and American Airlines subsidiary Envoy Air — illustrating how a single critical software vulnerability can simultaneously compromise a remarkably diverse set of universities, media companies, and consumer brands. (2) A SEPARATE, EARLIER incident: Estée Lauder disclosed a 2023 cybersecurity incident, and Clop reportedly listed it among victims of its MOVEit Transfer zero-day campaign (vector not confirmed by the company; not re-verified this pass) (the same underlying MOVEit vulnerability documented for Delta Dental, Hartford Insurance, TIAA, and AutoZone throughout this tracker).
Fees and billing
24 months of complimentary Kroll identity monitoring offered for the 2026 breach, with an enrollment deadline of October 31, 2026.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy esteelauder.com/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service esteelauder.com/terms-of-use | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.