THE ESTEE LAUDER COMPANIES INC.

The Estée Lauder Companies based in New York, New York, a business – retail or merchant entity reported a data breach to the Texas Attorney General. The breach was discovered on 2026-06-19 and reported on 2026-07-21. 1,959 Texas residents were affected. 31,859 individuals affected in total. Types of information involved: Name of individual;Address;Social Security Number Information;Government-issued ID number (e.g. passport, state ID card);Financial Information (e.g. account number, credit or debit card number);Medical Information;Other;Date of Birth. Consumers were notified via U.S. Mail.

The Estee Lauder Companies notified the NH AG of a cybersecurity incident involving a zero-day vulnerability in Oracle E-Business Suite. An unauthorized third party exploited this vulnerability to access and exfiltrate personal data from August 9-12, 2025. Affected data for ~72 NH residents includes names, SSNs, passport numbers, bank account numbers, health info, and employment records. The company patched the vulnerability, engaged forensic experts, notified law enforcement, and is offering 24 months of credit monitoring.

The Estée Lauder Companies notified the California AG of a data breach involving an unauthorized third party gaining access to their Oracle E-Business Suite HR system on or around August 9, 2025. The incident, discovered via investigation on June 19, 2026, exposed employee personal information including names, addresses, SSNs, passport numbers, bank account numbers, health information, and employment records. The company engaged cybersecurity experts, notified law enforcement, and offered 24 months of identity monitoring via Kroll.

The Estée Lauder Companies disclosed a cybersecurity incident involving its Oracle E-Business Suite HR system. Unauthorized access occurred between August 9-12, 2025, and was discovered on June 19, 2026. The breach exposed personal information including names, SSNs, passport numbers, financial account details, health information, and employment records. 2,110 Washington residents were affected. The company engaged forensic experts, notified law enforcement, and provided 24 months of identity monitoring via Kroll.

The Estee Lauder Companies notified Nebraska AG of a data breach involving its Oracle E-Business Suite HR system. Unauthorized access occurred on or around August 9, 2025. The breach exposed names, SSNs, passport numbers, financial account info, health data, and employment records. The company engaged Kroll for 24 months of identity monitoring and notified law enforcement. Notices were sent on July 17, 2026.

The Estee Lauder Companies disclosed a cybersecurity incident involving its Oracle E-Business Suite HR system. An unauthorized third party gained access on or around August 9, 2025, and the breach was discovered on June 19, 2026. Affected data included names, SSNs, passport numbers, financial account info, health info, and employment records. The company engaged forensic experts, notified law enforcement, and provided 24 months of Kroll identity monitoring to affected individuals.

The Estee Lauder Companies reported a data breach to the Vermont Attorney General. The breach was reported to the AGO on 2026-07-10. The reporting organization type is Other Commercial. 7 Vermont residents were affected. Categories of data breached: Social Security Numbers, Financial Account Codes, Credit and Debit Account Info, Government ID Numbers, Health Records.

THE ESTÉE LAUDER COMPANIES filed a data-breach notice with the Illinois Attorney General in July 2026 (case 26-07-1322). The register records the breach as discovered on June 19, 2026. Personal information types reported: financial account number, medical information, passport number, ssn. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

ELCOMPANIES.COM is the official website for The Estée Lauder Companies Inc., a multinational manufacturer and marketer of prestige skincare, makeup, fragrance, and hair care products. The company owns a diverse portfolio of brands, distributed internationally through both digital commerce and retail channels. It was founded in 1946 by Estée Lauder and her husband Joseph Lauder.

The Estée Lauder Companies Inc. reported a data breach to the Maine Attorney General, which was discovered on September 20, 2023, and occurred between May 30, 2023, and June 1, 2023. The breach was an external system breach (hacking) that affected one Maine resident, compromising their name and Driver's License or Non-Driver Identification Card Number. The company offered the affected individual two years of complimentary credit monitoring and identity protection services through Kroll.

The Estée Lauder Companies Inc. notified Washington AG of a cyberattack involving its third-party vendor Progress Software's MOVEit Transfer solution. Unauthorized access occurred May 30-June 1, 2023. The company discovered the issue on May 31, 2023. Approximately 1,453 Washington residents' names, emails, addresses, and DOBs were accessed. The incident is contained.

The Estée Lauder Companies Inc. reported a cybersecurity incident to the Washington AG on August 31, 2023. Unauthorized access occurred around July 11, 2023, affecting approximately 150,535 Washington residents. Consumer data included names, DOBs, and purchase details. Employee data included names, emails, and hashed/clear-text passwords. The company engaged forensic experts and law enforcement.

The Estée Lauder Companies Inc. reported a cybersecurity incident involving an unauthorized third party that gained access to some of the Company's systems; based on the current status of its investigation the Company believes the unauthorized party obtained some data from its systems and is working to understand the nature and scope of that data. The Company took down some of its systems, began an investigation with third-party cybersecurity experts and is coordinating with law enforcement, and states that the incident has caused, and is expected to continue to cause, disruption to parts of its business operations. The filing does not state the data types affected or the number of individuals impacted.

Estée Lauder | Beauty Products, Skin Care & Makeup

The Estée Lauder Companies Inc. is an American multinational cosmetics company, a manufacturer and marketer of makeup, skincare, fragrance and hair care products, based in Midtown Manhattan, New York City. It is the second largest cosmetics company in the world after L'Oréal.

esteelauder.com

The Estee Lauder Companies, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2017-07-14. 2 Massachusetts residents were affected. The report records the breach type as electronic.

The Estee Lauder Companies, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2011-07-18. 8 Massachusetts residents were affected. The report records the breach type as electronic.