Estée Lauder data breach 2026: HR records taken from Oracle E-Business Suite, 31,859 people notified

This is a different incident from the July 2023 attack on Estée Lauder's systems, which has its own entry.

What happened at Estée Lauder?

The company became aware of a vulnerability in its Oracle E-Business Suite system. On June 19, 2026, its investigation determined that an outsider had gained access to the system on or around August 9, 2025, and obtained some people's personal information. The letter does not name the flaw or say when the company first learned of it. It says the company investigated with outside cybersecurity experts, notified law enforcement and added safeguards to the system.

The date matches other organizations' notices. Five of the eight notices that name EBS give August 9, 2025 as the breach date; the Oracle E-Business Suite breach list has the full set. California's record gives August 9 to 12, 2025.

Date	What happened	Source
August 9 to 12, 2025	Access to the EBS system (August 9 in Indiana's record)	Letter; California and Indiana records
June 19, 2026	Investigation determines what happened	Letter
July 17, 2026	Letters dated; Indiana's notice date; reported to Washington and Massachusetts	Letter; Indiana, Washington and Massachusetts records
July 21, 2026	Texas publishes the report	Texas record

The letters went out 342 days after the access and 28 days after the company's finding.

What information was taken in the Estée Lauder breach?

A long list, because it was an HR system: names, postal and email addresses, dates of birth, Social Security numbers, passport numbers, bank account numbers, health information, and employment information such as performance evaluations and payroll. What was taken varied by person. Because contact details were in the data, the letter warns readers to watch for suspicious emails, texts and phone calls.

Massachusetts marks Social Security numbers and financial accounts for its 336 residents. Washington's list, which labels the filing "(Oracle)", shows 2,110 residents.

How many people were affected?

Indiana's total is 31,859. The state counts are 2,110 in Washington, 1,959 in Texas, 336 in Massachusetts and 156 in Indiana. The letter's question line is the company's HR Services.

What is Estée Lauder offering?

Twenty-four months of identity monitoring from Kroll at no cost, with activation open until October 31, 2026. That deadline has now passed. Questions go to HR Services at 1-928-212-9893 or 1-844-472-8352, Monday to Friday, 9 a.m. to 5 p.m. Eastern. The guide to credit monitoring offers covers what to do once an activation window has closed.

Was my information in the Estée Lauder data breach?

If you got a letter from The Estée Lauder Companies dated July 17, 2026, your HR record was in the data taken from the EBS system. Because passport numbers and bank account numbers were on the list for some people, check which items your letter names, and watch your bank statements as well as your credit reports.

What the notice leaves open

• When Estée Lauder first learned of the EBS vulnerability, and why its finding came in June 2026.
• Whether customers' data was in the system; the letter describes HR use only.
• Who carried out the attack.