Oracle E-Business Suite data breach: the eight organizations whose notices name it, and how many people

At least eight organizations have told people in breach notices that their data was taken from Oracle E-Business Suite (EBS), Oracle business software the notices describe using for finance, HR and back-office work, in 2025. Indiana's attorney general records totals for six of the eight notices, and those add up to 3,667,263 people. One notice, from the University of Phoenix, accounts for 3,489,274 of them, 95% of the total.

Key facts

• 8 organizations whose own notices name Oracle E-Business Suite: University of Phoenix, the University of Pennsylvania, Dartmouth College, Tulane University, Bimbo Bakeries USA, The Estée Lauder Companies, The Washington Post and Cox Enterprises.
• 3,667,263 people across the six notices with an Indiana total; Penn and Dartmouth gave Indiana only a resident count.
• 329,103 Texans across all eight, per Texas's attorney general.
• Breach dates cluster on August 9, 2025; the notices went out from November 2025 to September 2026.
• Checked November 11, 2026. This is a floor: it counts only notices that name the software.

Which organizations were affected by the Oracle E-Business Suite breach?

The table lists each organization whose own filed notice names Oracle E-Business Suite. It is ranked by the total in Indiana's record. Notice dates are Indiana's where it has one; Texas and Washington counts are residents of those states only.

Organization	What the notice says EBS held	Breach date	Notice	Indiana total	Texans	Washington residents
University of Phoenix	Not described	Aug 13, 2025	Dec 22, 2025	3,489,274	304,393	64,796
Tulane University	HR information	Aug 10, 2025	Apr 2, 2026	80,867	2,992	Not listed
Bimbo Bakeries USA	Files stored in EBS	Aug 9, 2025	Aug 31, 2026	46,064	3,982	786
The Estée Lauder Companies	HR management	Aug 9, 2025	Jul 17, 2026	31,859	1,959	2,110
The Washington Post	Oracle application environment	Jul 10, 2025	Nov 12, 2025	9,720	862	514
Cox Enterprises	Back-office operations	Aug 9 to 14, 2025	Nov 20, 2025	9,479	1,504	Not listed
The University of Pennsylvania	Supplier payments, reimbursements, general ledger	Aug 9, 2025	Dec 1, 2025	Not given (2,067 in Indiana)	11,455	6,413
Dartmouth College	Operations management	Aug 9, 2025	Nov 24, 2025	Not given (413 in Indiana)	1,956	1,496

The Washington Post sent a second round of notices in July 2026, reported to Washington on July 13, 2026 with 514 residents; the Indiana total in the table is from its November 2025 notice. Washington's list itself labels four of these filings "(Oracle)": Penn, The Washington Post, Estée Lauder and Bimbo Bakeries.

What happened to Oracle E-Business Suite?

The notices describe the same event from different sides. Attackers used a flaw in E-Business Suite that was unknown when they used it, a zero-day, to take data from many customers' systems. Bimbo Bakeries' filing says the flaw let unauthorized parties exploit hundreds of Oracle customers' EBS instances. Cox says the activity ran from August 9 to 14, 2025.

Most organizations learned of it weeks later. Cox became aware of suspicious activity on September 29, 2025. The Washington Post says it was contacted that same day by a bad actor who claimed to have gained access to its Oracle E-Business Suite applications. Bimbo Bakeries first learned of the zero-day on October 6, 2025 and applied Oracle's patches. The University of Phoenix says it learned on November 21, 2025 that an EBS vulnerability may have led to an incident.

CISA added the flaw, CVE-2025-61882 in the BI Publisher Integration component, to its Known Exploited Vulnerabilities catalog on October 6, 2025, and marks it as known to be used in ransomware campaigns. Daily CISO's week of October 6, 2025 covers the catalog entry for security teams. None of the eight notices names the CVE or the group behind the attacks.

What did the organizations use E-Business Suite for?

It depends on the organization, and that decides whose data was in it. Penn describes EBS as a financial application for supplier payments, reimbursements and general ledger entries. Estée Lauder used it for HR management, and Tulane for human resources information, so their letters concern employment records. Cox used it for back-office business operations, and Dartmouth to help manage its operations.

The data in the letters follows from that. The Washington Post lists names, bank account and routing numbers, health insurance information, employee ID numbers, Social Security and tax ID numbers, among others. Bimbo Bakeries' California letter names a file holding the reader's name and Social Security number.

Why did the letters take so long?

The theft happened in a few days in August 2025, but the organizations then had to find out which files were taken and whose details were in them. Estée Lauder determined on June 19, 2026 that an unauthorized party had gained access around August 9, 2025, more than ten months later. Bimbo Bakeries identified the reader's file on August 19, 2026, and Tulane on March 12, 2026.

Measured from each breach date to the notice date in the table, the gaps run from 103 days (Cox) to 387 days (Bimbo Bakeries). The notice-delay guide compares gaps like these with other notices, and the vendor breach guide covers notices that trace back to someone else's software.

How this list was built

Washington's attorney general posts a PDF of every notice it receives. This page read all of the notices on its list with a breach date from July through December 2025: 87 filings, of which 85 downloaded. Six name Oracle E-Business Suite. Two more, Cox and Tulane, come from letters filed in California, and Bimbo Bakeries and Estée Lauder appear in both states. Each organization's totals were then matched by name in Indiana's 2025 and 2026 year-to-date reports and in Texas's breach list. Organizations hit through EBS that never named it in a notice, or that filed only in states not checked here, are not counted, so the real numbers are higher.

Frequently asked questions

Was Oracle E-Business Suite hacked?

Yes. Attackers used a zero-day flaw in E-Business Suite in 2025 to take files from customers' own EBS systems, according to the notices those customers filed. The flaw was in Oracle's software, and the data was taken from each customer's installation, so each customer sent its own notices.

Which companies were affected by the Oracle EBS breach?

The eight in the table: University of Phoenix, Tulane University, Bimbo Bakeries USA, The Estée Lauder Companies, The Washington Post, Cox Enterprises, the University of Pennsylvania and Dartmouth College. These are the organizations whose own notices name the software. Bimbo Bakeries' filing says hundreds of Oracle customers' instances were exploited, so the full list is longer.

How many people were affected by the Oracle E-Business Suite breach?

3,667,263 people across the six notices that give Indiana a total, and 329,103 Texans across all eight. The University of Phoenix notice alone counts 3,489,274 people. No public source gives a single total for every Oracle customer.

Why did I get a letter about Oracle E-Business Suite?

Because an organization you worked for, studied at, or did business with ran E-Business Suite, and your record was in a file taken from it. For Estée Lauder and Tulane the system held HR records; for Penn and Cox, finance and back-office records. The Tulane entry walks through one of these letters in full.