Bimbo Bakeries USA data breach: employee files taken through Oracle E-Business Suite, 46,064 people notified

What happened at Bimbo Bakeries USA?

Bimbo Bakeries uses Oracle EBS to keep business information. Its filing says the software had a zero-day flaw that let attackers exploit hundreds of Oracle customers' EBS systems and take data, its own among them. The company first learned of the flaw on October 6, 2025, applied Oracle's patches straight away and opened an investigation. At that point it did not know whether its own system had been hit. The investigation later found that the flaw had let outsiders reach and take files stored in the application.

Date	What happened	Source
August 9, 2025	Breach date in Indiana's and Washington's records	Indiana and Washington records
October 6, 2025	Bimbo Bakeries learns of the zero-day and applies Oracle's patches	Washington notice
August 19, 2026	Review finds names and Social Security numbers in the files	Washington notice; letter
August 28, 2026	Company confirms 786 Washington residents are involved	Washington notice
August 31, 2026	Letters begin; Indiana's notice date	Washington notice; Indiana record
September 4, 2026	Reported to Washington, Texas and Massachusetts	Washington, Texas and Massachusetts records

The letters went out 387 days after the breach date, the longest gap among the organizations whose notices name EBS. The file review took most of it: the company determined what the files held on August 19, 2026. The Oracle E-Business Suite breach list compares its timeline with seven others.

What information was in the Bimbo Bakeries breach?

For everyone in the notice: name and Social Security number. For some current and former employees, bank account and routing numbers as well. Texas lists name, Social Security number and financial information for its 3,982 residents. Massachusetts marks Social Security numbers and financial accounts for its 363 residents.

How many people were affected?

Indiana counts 46,064 people in total. The state counts are 3,982 in Texas, 804 in Indiana, 786 in Washington and 363 in Massachusetts. Washington's list labels the filing "(Oracle)". The notice describes current and former employees, their dependents and beneficiaries, and other people affiliated with the company. It does not mention customers.

What is Bimbo Bakeries offering?

Twelve months of single-bureau credit monitoring, a credit report and score, and fraud assistance from Cyberscout, a TransUnion company, at no charge, for people whose Social Security numbers were involved. Questions go to 1-833-851-8839, Monday to Friday, 8 a.m. to 8 p.m. Eastern. The company says it is re-evaluating its vendor relationships to prevent a repeat. The guide to credit monitoring offers compares what offers like this cover.

Was my information in the Bimbo Bakeries data breach?

If you work or worked for Bimbo Bakeries USA, or are a dependent or beneficiary of someone who did, and you got a letter from late August 2026 onward, your name and Social Security number were in the files. If your bank details for direct deposit were also involved, the letter says so. The vendor breach guide explains how notices describe a breach that began in someone else's software.

What the notice leaves open

• Who exploited the flaw, and whether they made any demand of the company.
• Why the file review ran until August 2026.
• How many of the 46,064 are current employees, former employees, or family members.