The Estee Lauder Companies data breach

Clerk's notes

On July 17, 2026, The Estee Lauder Companies officially reported a data security incident to the Indiana Attorney General. This filing indicates that a breach affecting consumer data took place on or around August 9, 2025. The investigation into this incident remains in a monitoring status as of the filing date.

The breach potentially exposed a range of sensitive consumer data, including Full Name, Email Address, Password or Credential Hash, Mailing Address, Purchase and Order History, Payment Card Information, Phone Number, and Loyalty Account Details. Such information, if compromised, can put individuals at heightened risk for targeted phishing scams, unauthorized transactions, or even identity theft.

As a company handling vast amounts of consumer data, The Estee Lauder Companies is subject to state consumer protection laws and Section 5 of the Federal Trade Commission Act, which mandates reasonable security measures to protect consumer information. The occurrence of this data breach suggests potential gaps in the company's security protocols, which are legally obligated to prevent unauthorized access to personal data.

Receiving a data breach notification letter from The Estee Lauder Companies signifies that your personal information was directly involved in this security event. This official notification provides you with legal standing to explore potential recourse. You do not need to have already experienced financial loss or identity theft to consider your options; the increased risk and privacy violation itself can be actionable.

If you have received a data breach notification concerning The Estee Lauder Companies incident, you may be entitled to legal review. Our firm evaluates these cases on a contingency fee basis, meaning there are no out-of-pocket costs to you unless we achieve a successful outcome.

If a notification letter about this breach reached you, see every Indiana data breach on file or browse all cases.