InfoSecBulletin Cybersecurity for mankind
Bimbo Bakeries USA has confirmed that hackers stole employee data by exploiting a zero-day vulnerability in Oracle’s E-Business Suite (EBS). In a letter dated August 31, 2026, and shared with the California Attorney General’s office on September 4, the bakery company explained that the issue started with a third-party vendor that used Oracle EBS.
Bimbo Oracle EBS Data Breach
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
The company found out on December 6, 2025, that hackers used a new vulnerability to get files stored in the system. Bimbo Bakeries said it used Oracle’s emergency fixes right after it found out about the problem and started an investigation to see what data was shown.
That review took many months. The company did not confirm until August 19, 2026, that one of the stolen files had names and Social Security numbers of victims. This started the official notice process needed by state breach laws.
Bimbo Bakeries’ letter does not say the exact flaw, but the dates and vendor fit a well-known issue linked to CVE-2025-61882. This is a serious security flaw that allows remote code execution in the BI Publisher Integration part of Oracle EBS’s Concurrent Processing module.
The bug, rated 9.8 on the CVSS scale, allowed attackers to run any code on unpatched EBS servers without valid credentials. Mandiant, owned by Google, found that the exploitation started in August 2025, a few weeks before Oracle released an emergency patch on October 4, 2025.
Researchers said the Clop extortion group likely to run the campaign. They used a flaw to steal data from many Oracle EBS customers, like Harvard University and The Washington Post. Then, they pressured the victims for ransom.
CISA listed the vulnerability in its Known Exploited Vulnerabilities catalog soon after Oracle shared the information. Bimbo Bakeries has not said publicly that Clop was behind the breach, how many people were affected, or if it got a demand for money.
Bimbo Bakeries said it is “re-evaluating its vendor relationships” following the incident and is offering affected individuals 12 months of free single-bureau credit monitoring and fraud assistance through Cyberscout.
Security experts are still telling organizations using Oracle EBS versions 12.2.3 to 12.2.14 to make sure they apply the October 2025 emergency patch. They should check logs for suspicious BI Publisher activity from mid-2025 and change credentials for EBS connections.
Affected people should check their credit reports, turn on fraud alerts, and be careful of phishing attempts connected to the breach.
