InfoSecBulletin Cybersecurity for mankind
Bimbo Bakeries USA has confirmed that hackers stole employee data by exploiting a zero-day vulnerability in Oracle’s E-Business Suite (EBS). In a letter dated August 31, 2026, and shared with the California Attorney General’s office on September 4, the bakery company explained that the issue started with a third-party vendor that used Oracle EBS.
Bimbo Oracle EBS Data Breach
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
The company found out on December 6, 2025, that hackers used a new vulnerability to get files stored in the system. Bimbo Bakeries said it used Oracle’s emergency fixes right after it found out about the problem and started an investigation to see what data was shown.
That review took many months. The company did not confirm until August 19, 2026, that one of the stolen files had names and Social Security numbers of victims. This started the official notice process needed by state breach laws.
Bimbo Bakeries’ letter does not say the exact flaw, but the dates and vendor fit a well-known issue linked to CVE-2025-61882. This is a serious security flaw that allows remote code execution in the BI Publisher Integration part of Oracle EBS’s Concurrent Processing module.
The bug, rated 9.8 on the CVSS scale, allowed attackers to run any code on unpatched EBS servers without valid credentials. Mandiant, owned by Google, found that the exploitation started in August 2025, a few weeks before Oracle released an emergency patch on October 4, 2025.
Researchers said the Clop extortion group likely to run the campaign. They used a flaw to steal data from many Oracle EBS customers, like Harvard University and The Washington Post. Then, they pressured the victims for ransom.
CISA listed the vulnerability in its Known Exploited Vulnerabilities catalog soon after Oracle shared the information. Bimbo Bakeries has not said publicly that Clop was behind the breach, how many people were affected, or if it got a demand for money.
Bimbo Bakeries said it is “re-evaluating its vendor relationships” following the incident and is offering affected individuals 12 months of free single-bureau credit monitoring and fraud assistance through Cyberscout.
Security experts are still telling organizations using Oracle EBS versions 12.2.3 to 12.2.14 to make sure they apply the October 2025 emergency patch. They should check logs for suspicious BI Publisher activity from mid-2025 and change credentials for EBS connections.
Affected people should check their credit reports, turn on fraud alerts, and be careful of phishing attempts connected to the breach.
