The Oracle breach

Organisations affected through Oracle

1. L LKQUSUnited States · TN · 15 December 2025 Social Security numbersNamesAddresses 1.1KTexas residents
   Oracle announced a number of security vulnerabilities, including a previously unknown vulnerability in its E-Business Suite application, which is used by LKQ notice letter
2. MS Madison Square Garden EntertainmentUSUnited States · 26 February 2026 38.4Kpeople
   The Oracle eBusiness Suite, hosted and managed for us by a vendor, is used for certain workforce and financial operations. Oracle notified its customers that a previously undisclosed condition in the application had been exploited by an unauthorized person notice letter
3. MH Maritz Holdings Inc. (“Maritz”)USUnited States · MO · 27 February 2026 Social Security numbersFinancial account and card detailsNames+1 4.9Kpeople
   Oracle announced a previously unknown vulnerability in its Oracle E-Business Suite (EBS) application, which is used by Maritz and many other organizations worldwide. notice letter
4. IC Informa Canada Inc. dba Shop FAN EXPOUSUnited States · 17 April 2026 Social Security numbersFinancial account and card detailsDates of birth+1 2.3Kpeople
   One of our third-party technology providers, Oracle, was recently involved in a security incident that affected its E-Business Suite software notice letter
5. NN Nissan North AmericaUSUnited States · TN · 25 June 2026 Social Security numbersFinancial account and card details 85people
   Nissan Americas uses Oracle PeopleSoft software to manage employee information, including payroll, tax administration, and other personnel records. Oracle has informed us that there was a cyber event and that the personnel records of hundreds of companies may have been obtained by so-called threat actors. notice letter
6. TE The Estee Lauder CompaniesUSUnited States · NY · 10 July 2026 Social Security numbersGovernment ID numbersHealth and medical information+4 31.9Kpeople
   a vulnerability in the Oracle E-Business Suite system which is used by the Estee Lauder Companies for HR management purposes notice letter
7. TW The Washington PostUSUnited States · DC · 13 July 2026 Social Security numbersGovernment ID numbersHealth insurance details+3 862Texas residents
   data security incident the Washington Post ("The Post") experienced that resulted from an unknown vulnerability in software we utilize from our vendor, Oracle notice letter
8. BB Bimbo Bakeries USA (Oracle)USUnited States · TX · 31 August 2026 Social Security numbersFinancial account and card detailsNames 46.1Kpeople
   Oracle's eBusiness Suite Application ("Oracle EBS") had a zero-day vulnerability that allowed unauthorized parties to exploit hundreds of Oracle customers EBS instances and access / exfiltrate data, including Bimbo Bakeries USA's ("BBU") Washington Attorney General

Counts are each organisation’s own and can overlap: one person can be a customer of several. An organisation joins this list only when a source names Oracle as the way its data was taken.