Maritz data breach: files taken from its Oracle E-Business Suite before the flaw was public

Date	Event
August 10 to 13, 2025	Files taken from Maritz's Oracle EBS environment
October 2025	Oracle announces the previously unknown vulnerability
November 2025	Maritz learns that data may have been accessed; investigation, outside experts, law enforcement told
February 27, 2026	Letters; reports to Massachusetts (130 residents) and Vermont

What happened at Maritz?

Maritz was one of many Oracle E-Business Suite customers whose data was taken through a flaw nobody knew about at the time. Its letter says Oracle announced the previously unknown vulnerability in October 2025, and that the application is used by Maritz and many other organizations worldwide. Maritz says it took steps to contain and investigate once it knew of the flaw. In November 2025 it learned that data might have been taken from its own instance. It then brought in outside cybersecurity experts and notified law enforcement.

The investigation dated the theft to August 10 to 13, 2025, two months before the announcement. Other notices in this log give much the same window. The Oracle E-Business Suite guide lists the organizations whose letters this site has read. Madison Square Garden Entertainment is another, with hiring and payment records taken in August 2025.

Why did Maritz have my information?

Because of money moving through its finance system. The letter says Maritz uses Oracle EBS mainly for finance work, including invoicing, receiving payments and issuing payments through accounts payable. Someone Maritz paid, or who paid Maritz, could have a record there. The letter does not say whether the people notified are employees, suppliers, customers or others. The guide to letters from a company you never dealt with covers how a person ends up in another firm's files.

What information was exposed?

The filed copy leaves the data list as a template field after "your name". The Massachusetts record marks Social Security numbers and financial accounts.

Record	People	Data it marks
Massachusetts OCABR, report 2026-305 (February 27, 2026)	130	SSNs, financial accounts
Vermont AG, notice to consumers (February 27, 2026)	Not given	Name and template fields

What is Maritz offering?

A 24-month membership to Experian IdentityWorks credit monitoring at no cost. The letter says enrolling will not hurt a credit score, and that Maritz has added measures to protect its systems and data. Questions go to 833-918-3973, 9 a.m. to 9 p.m. Eastern on weekdays. For how the offer compares, see the credit monitoring guide.

Why did the letters take six months?

The theft happened in August, but Maritz did not learn of it until November, after Oracle's October announcement. It then had to review the files to find whose information was in them. From the end of the theft on August 13, 2025 to the letters on February 27, 2026 is 198 days. The notice letter delay guide compares that gap with other notices.

What the documents leave open

• The total number of people notified across all states.
• Which data fields were in the files for each person.
• Whether the data has been published.