{"id":29347,"date":"2026-07-21T10:56:48","date_gmt":"2026-07-21T08:56:48","guid":{"rendered":"https:\/\/itbranschen.com\/?p=29347"},"modified":"2026-07-21T10:57:01","modified_gmt":"2026-07-21T08:57:01","slug":"estee-lauder-dataindtastning-oracle-e-business-suite","status":"publish","type":"post","link":"https:\/\/itbranschen.com\/da\/estee-lauder-dataintrang-oracle-e-business-suite\/","title":{"rendered":"Est\u00e9e Lauder bekr\u00e6fter databrud efter brud p\u00e5 Oracle E-Business Suite"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><strong>Kosmetikfirmaet <a href=\"https:\/\/www.elcompanies.com\/en\/\" target=\"_blank\" rel=\"noreferrer noopener\">Est\u00e9e Lauder<\/a> er begyndt at informere ber\u00f8rte personer om et databrud, efter at en angriber udnyttede en s\u00e5rbarhed i virksomhedens Oracle E-Business Suite-milj\u00f8, som bruges til HR-relaterede forretningsprocesser.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If\u00f8lge virksomheden blev h\u00e6ndelsen opdaget sidste m\u00e5ned. Den efterf\u00f8lgende unders\u00f8gelse viste, at en uautoriseret akt\u00f8r sandsynligvis tilgik systemet omkring den 9. august 2025 og fik adgang til personoplysninger vedr\u00f8rende en r\u00e6kke personer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I sit informationsbrev skriver han: <a href=\"https:\/\/itbranschen.com\/tag\/estee-lauder\/\" data-type=\"post_tag\" data-id=\"7871\">Est\u00e9e Lauder<\/a> at virksomheden identificerede et cybersikkerhedsproblem knyttet til en s\u00e5rbarhed i Oracle E-Business Suite, platformen der bruges til HR-styring i koncernen.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ydermere oplyser virksomheden, at den interne unders\u00f8gelse, der blev afsluttet den 19. juni 2026, viste, at en uautoriseret tredjepart havde f\u00e5et adgang til systemet omkring den 9. august 2025 og derved tilegnet sig personoplysninger.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Personoplysninger kan v\u00e6re blevet eksponeret<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If\u00f8lge et eksempel p\u00e5 det informationsbrev, der blev sendt til de ber\u00f8rte personer, kan f\u00f8lgende oplysninger v\u00e6re inkluderet i databruddet:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Fulde navn<\/li>\n\n\n\n<li>Postadresse<\/li>\n\n\n\n<li>E-mailadresse<\/li>\n\n\n\n<li>F\u00f8dselsdato<\/li>\n\n\n\n<li>CPR-nummer (SSN)<\/li>\n\n\n\n<li>Pasnummer<\/li>\n\n\n\n<li>Bankkontooplysninger<\/li>\n\n\n\n<li>Sundhedsoplysninger<\/li>\n\n\n\n<li>Ans\u00e6ttelsesrelaterede oplysninger, herunder l\u00f8n- og pr\u00e6stationsdata<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">De data, der p\u00e5virkes, varierer mellem forskellige individer.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Tidslinjen peger p\u00e5 en kendt Oracle-s\u00e5rbarhed<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Est\u00e9e Lauder har ikke afsl\u00f8ret s\u00e5rbarheden bag bruddet, men timingen falder sammen med den store b\u00f8lge af angreb, der var rettet mod Oracle E-Business Suite i 2025 via sikkerhedsfejlen. <strong>CVE-2025-61882<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I oktober 2025 rapporterede sikkerhedsforskere fra Google Mandiant, at Clop ransomware-gruppen udnyttede s\u00e5rbarheden som en s\u00e5kaldt zero-day-s\u00e5rbarhed til at stj\u00e6le data fra et stort antal organisationer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">S\u00e5rbarheden p\u00e5virkede Oracle E-Business Suite version 12.2.3 til 12.2.14 og tillod angribere at omg\u00e5 godkendelse og i nogle tilf\u00e6lde udf\u00f8re kode eksternt via BI Publisher Integration-komponenten. Et vellykket angreb kunne give adgang til f\u00f8lsomme HR- og forretningsdata.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Orakel <strong><a href=\"https:\/\/support.oracle.com\/support\/?kmContentId=3106344\" target=\"_blank\" rel=\"noreferrer noopener\">offentliggjorte sikkerhedsopdateringer<\/a><\/strong> for CVE-2025-61882 den 4. oktober 2025. Kort efter bekr\u00e6ftede cybersikkerhedsfirmaet CrowdStrike, at Clop havde udnyttet s\u00e5rbarheden siden begyndelsen af august samme \u00e5r.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Flere store organisationer blev ber\u00f8rt<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Kampagnen knyttet til Oracle-s\u00e5rbarheden har tidligere p\u00e5virket flere store organisationer, herunder:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Harvard Universitet<\/li>\n\n\n\n<li>Universitetet i Pennsylvania<\/li>\n\n\n\n<li>Dartmouth<\/li>\n\n\n\n<li>Universitetet i Phoenix<\/li>\n\n\n\n<li>Washington Post<\/li>\n\n\n\n<li>Logitech<\/li>\n\n\n\n<li>GlobalLogic<\/li>\n\n\n\n<li>Cox Enterprises<\/li>\n\n\n\n<li>Envoy Air, et datterselskab af American Airlines<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Der er dog ingen offentlig bekr\u00e6ftelse p\u00e5, at den samme trusselsakt\u00f8r stod bag indbruddet hos Est\u00e9e Lauder.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Tilbyder identitetsoverv\u00e5gning<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Est\u00e9e Lauder opfordrer ber\u00f8rte til at v\u00e6re opm\u00e6rksomme p\u00e5 tegn p\u00e5 identitetstyveri og \u00f8konomisk svindel og tilbyder 24 m\u00e5neders gratis identitetsoverv\u00e5gning gennem sikkerhedsfirmaet Kroll.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Anden gang virksomheden er forbundet med Clop<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Det er ikke f\u00f8rste gang, at Est\u00e9e Lauder har v\u00e6ret udsat for en st\u00f8rre cybersikkerhedsh\u00e6ndelse.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I 2023 blev virksomheden ogs\u00e5 p\u00e5virket af den globale b\u00f8lge af angreb mod filoverf\u00f8rselsplatformen. <a href=\"https:\/\/itbranschen.com\/progress-lanserar-waf-for-moveit-cloud-saker-filoverforing-med-pci-4-0\/\" data-type=\"post\" data-id=\"11085\">FLYT dig<\/a> Transfer, hvor ransomware-gruppen Clop udnyttede en kritisk zero-day-s\u00e5rbarhed til at stj\u00e6le data fra hundredvis af organisationer verden over.<\/p>\n\n\n\n<div data-wp-interactive=\"core\/file\" class=\"wp-block-file\"><object data-wp-bind--hidden=\"!state.hasPdfPreview\" hidden class=\"wp-block-file__embed\" data=\"https:\/\/itbranschen.com\/wp-content\/uploads\/2026\/07\/elc-us-individual-notification-letter.pdf\" type=\"application\/pdf\" style=\"width:100%;height:920px\" aria-label=\"Integrer elc-us-individual-notification-letter.\"><\/object><a id=\"wp-block-file--media-a4069098-78bb-4697-9ea5-084a895a631e\" href=\"https:\/\/itbranschen.com\/wp-content\/uploads\/2026\/07\/elc-us-individual-notification-letter.pdf\">elc-us-individuel-meddelelsesbrev<\/a><a href=\"https:\/\/itbranschen.com\/wp-content\/uploads\/2026\/07\/elc-us-individual-notification-letter.pdf\" class=\"wp-block-file__button wp-element-button\" aria-describedby=\"wp-block-file--media-a4069098-78bb-4697-9ea5-084a895a631e\" download>Download<\/a><\/div>","protected":false},"excerpt":{"rendered":"\u200b\ufeffEst\u00e9e Lauders Oracle E-Business Suite utsattes f\u00f6r en s\u00e5rbarhet som m\u00f6jliggjorde datast\u00f6ld av k\u00e4nsliga personuppgifter, en attackdel i en bredare kampanj kopplad till ransomwaregruppen Clop.\ufeff\u200b","protected":false},"author":1,"featured_media":29352,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"csco_display_header_overlay":false,"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","csco_post_video_location":[],"csco_post_video_location_hash":"","csco_post_video_url":"","csco_post_video_bg_start_time":0,"csco_post_video_bg_end_time":0,"footnotes":""},"categories":[21,11],"tags":[7868,1590,7876,31,6560,1125,2083,2459,7874,7871,7875,7870,3730,7873,1483,7869,7872,2682,62,5930],"itb_content_type":[],"class_list":["post-29347","post","type-post","status-publish","format-standard","has-post-thumbnail","category-nyheter","category-cybersakerhet","tag-clop","tag-crowdstrike","tag-cve-2025-61882","tag-cybersakerhet","tag-data-breach","tag-dataintrang","tag-enterprise-security","tag-erp","tag-erp-security","tag-estee-lauder","tag-google-mandiant","tag-hr-system-2","tag-identity-security","tag-kroll","tag-oracle","tag-oracle-e-business-suite","tag-oracle-security","tag-patch-management","tag-ransomware","tag-vulnerability-management","cs-entry","cs-video-wrap"],"_links":{"self":[{"href":"https:\/\/itbranschen.com\/da\/wp-json\/wp\/v2\/posts\/29347","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/itbranschen.com\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itbranschen.com\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itbranschen.com\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/itbranschen.com\/da\/wp-json\/wp\/v2\/comments?post=29347"}],"version-history":[{"count":0,"href":"https:\/\/itbranschen.com\/da\/wp-json\/wp\/v2\/posts\/29347\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/itbranschen.com\/da\/wp-json\/wp\/v2\/media\/29352"}],"wp:attachment":[{"href":"https:\/\/itbranschen.com\/da\/wp-json\/wp\/v2\/media?parent=29347"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itbranschen.com\/da\/wp-json\/wp\/v2\/categories?post=29347"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itbranschen.com\/da\/wp-json\/wp\/v2\/tags?post=29347"},{"taxonomy":"itb_content_type","embeddable":true,"href":"https:\/\/itbranschen.com\/da\/wp-json\/wp\/v2\/itb_content_type?post=29347"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}