HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedAuthenticationCredentialsIdentity (basic)Government IDCriticalContained

THE ESTEE LAUDER COMPANIES INC.

bd_e073c9131d35a119 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jul 11, 2023

Filed

Aug 31, 2023

To disclose

7 weeks

Affected

150,535state residents only

Linked

6 filings

Confidence

70%

Full breach record for THE ESTEE LAUDER COMPANIES INC. →5 incidents on file

The Estée Lauder Companies Inc. reported a cybersecurity incident to the Washington AG on August 31, 2023. Unauthorized access occurred around July 11, 2023, affecting approximately 150,535 Washington residents. Consumer data included names, DOBs, and purchase details. Employee data included names, emails, and hashed/clear-text passwords. The company engaged forensic experts and law enforcement.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d7 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 7 weeks / 51 days

Jul 11, 2023

Begins

Jul 11, 2023

Discovered

Aug 31, 2023

Filed

vs. sector median

on median

This filing is one of 6 about the same incident.View merged incident

A leak claim by alphv about this victim predates this filing by 44 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitecl0pbd_a40c32bc2fe400a42023-07-19 · +43dVerified
Leak Sitealphvbd_222b45685f496a632023-07-18 · +44dVerified by operator

Regulatory filings (3) · sorted by filing gap

SEC 8-Kbd_029686f81d388b6c2023-07-19 · +43dVerified by operator
Washington State AGbd_6f12f71586422ae62023-10-18 · +48dCandidate
Maine State AGbd_a9dea68820cb2a8e2023-10-19 · +49dVerified by operator

Name: Hunton Andrews Kurth LLP
norm: hunton andrews kurth

Name: THE ESTEE LAUDER COMPANIES INC.
norm: the estee lauder companies
Domain: esteelauder.com
Industry: Retail & Consumerllm

Discovered: Jul 11, 2023
Breach occurred: Jul 11, 2023 – Aug 20, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 150,535state-resident count only
Data types: Identity (basic)Government IDCredentials
Data elements: NameDate of birthUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: coordinating with law enforcement authorities
Initial access: valid_credentials

During the incident: Proactively took steps to secure its systems
Engaged leading cybersecurity experts to assist with its investigation
Notified and is coordinating with law enforcement regarding this issue
Put in place additional monitoring measures to further protect our systems
Offering optional identity monitoring services at no cost
Changes made: Change your Company system password
Change your password for any other online account on which you used a password that is the same or similar to your Company system password
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(51 days from discovery to filing)
Compliance flags: WA AG >30dLeak >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 2 states

View merged incident ↗

SEC 8-KJul 19 · first

Washington State AG+43d · this page

Washington State AG+91d

Maine State AG+92d

Pattern: first filing Jul 19, last Oct 19 (ME) — a 92-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26398.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 31, 2023
Raw hash: 13c7512f9e5bd023fbbdee0b078ab8af0e056592d613acc141e50bde67b6c278

Linked disclosures

Ransomware claims (2)

Regulatory filings (3) · sorted by filing gap

Reporting entityHunton Andrews Kurth LLP

Victim entityTHE ESTEE LAUDER COMPANIES INC.

Incidentdiscovered Jul 11, 2023

Stated responseProactively took steps to secure its systems

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com