InfoSecBulletin Cybersecurity for mankind
Bimbo Bakeries USA has confirmed that hackers stole employee data by exploiting a zero-day vulnerability in Oracle’s E-Business Suite (EBS). In a letter dated August 31, 2026, and shared with the California Attorney General’s office on September 4, the bakery company explained that the issue started with a third-party vendor that used Oracle EBS.
Bimbo Oracle EBS Data Breach
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
The company found out on December 6, 2025, that hackers used a new vulnerability to get files stored in the system. Bimbo Bakeries said it used Oracle’s emergency fixes right after it found out about the problem and started an investigation to see what data was shown.
That review took many months. The company did not confirm until August 19, 2026, that one of the stolen files had names and Social Security numbers of victims. This started the official notice process needed by state breach laws.
Bimbo Bakeries’ letter does not say the exact flaw, but the dates and vendor fit a well-known issue linked to CVE-2025-61882. This is a serious security flaw that allows remote code execution in the BI Publisher Integration part of Oracle EBS’s Concurrent Processing module.
The bug, rated 9.8 on the CVSS scale, allowed attackers to run any code on unpatched EBS servers without valid credentials. Mandiant, owned by Google, found that the exploitation started in August 2025, a few weeks before Oracle released an emergency patch on October 4, 2025.
Researchers said the Clop extortion group likely to run the campaign. They used a flaw to steal data from many Oracle EBS customers, like Harvard University and The Washington Post. Then, they pressured the victims for ransom.
CISA listed the vulnerability in its Known Exploited Vulnerabilities catalog soon after Oracle shared the information. Bimbo Bakeries has not said publicly that Clop was behind the breach, how many people were affected, or if it got a demand for money.
Bimbo Bakeries said it is “re-evaluating its vendor relationships” following the incident and is offering affected individuals 12 months of free single-bureau credit monitoring and fraud assistance through Cyberscout.
Security experts are still telling organizations using Oracle EBS versions 12.2.3 to 12.2.14 to make sure they apply the October 2025 emergency patch. They should check logs for suspicious BI Publisher activity from mid-2025 and change credentials for EBS connections.
Affected people should check their credit reports, turn on fraud alerts, and be careful of phishing attempts connected to the breach.
