Bimbo Bakeries USA Confirms Data Breach After Oracle EBS Zero-Day Attack

Key Takeaways

• Bimbo Bakeries USA confirmed a data breach stemming from a zero-day exploit in Oracle’s E-Business Suite (EBS).
• Employee names and Social Security numbers were stolen due to a vulnerability in a third-party vendor’s Oracle EBS instance.
• The attack is linked to CVE-2025-61882, a critical remote code execution flaw with a CVSS score of 9.8, exploited by the Clop ransomware group.
• Oracle issued an emergency patch for the vulnerability on October 4, 2025, weeks after initial exploitation was detected.

Bimbo Bakeries USA, the U.S. division of the world’s largest baking conglomerate, has officially acknowledged a data breach. The incident involved the theft of employee information, orchestrated by hackers who leveraged a zero-day vulnerability within Oracle’s E-Business Suite (EBS). This attack places Bimbo Bakeries among a growing list of organizations targeted by the Clop ransomware gang’s extensive extortion campaign against Oracle customers worldwide.

A notification letter, dated August 31, 2026, and submitted to the California Attorney General’s Office on September 4, confirmed the breach. The bakery giant indicated that the compromise originated with a third-party vendor utilizing Oracle EBS.

Oracle EBS Vulnerability Exploited

Discovery and Disclosure Timeline

The company’s investigation, concluded on December 6, 2025, determined that attackers had successfully exploited the zero-day flaw to exfiltrate files from the platform. Bimbo Bakeries stated it promptly applied Oracle’s emergency patches upon learning of the vulnerability and initiated a comprehensive forensic review to ascertain the precise scope of data exposure.

The forensic analysis was a multi-month endeavor. It wasn’t until August 19, 2026, that the company definitively confirmed that one of the compromised files contained the names and Social Security numbers of affected individuals. This confirmation triggered the formal notification procedures mandated by state breach-disclosure regulations.

The Critical Flaw: CVE-2025-61882

Although Bimbo Bakeries’ official communication does not explicitly name the vulnerability, the timeline and the involvement of a vendor align with details surrounding CVE-2025-61882. This critical unauthenticated remote code execution vulnerability affects the BI Publisher Integration component within Oracle EBS’s Concurrent Processing module. With a CVSS score of 9.8, this flaw allowed attackers to execute arbitrary code on vulnerable EBS servers without requiring any authentication credentials.

Mandiant, a cybersecurity firm owned by Google, tracked exploitation of this vulnerability back to August 2025, several weeks before Oracle released an emergency patch on October 4, 2025. Researchers have attributed the campaign exploiting this flaw to the Clop extortion group, which has used it to steal data from numerous Oracle EBS clients, including prominent institutions like Harvard University and The Washington Post, subsequently demanding ransom payments.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-61882 to its Known Exploited Vulnerabilities catalog shortly after Oracle’s public disclosure. While Bimbo Bakeries has not publicly linked the breach to Clop, disclosed the exact number of affected individuals, or confirmed any extortion demands, the circumstances strongly suggest a connection.

Company Response and Mitigation

In the wake of the incident, Bimbo Bakeries announced it is “re-evaluating its vendor relationships.” To support affected individuals, the company is providing 12 months of complimentary single-bureau credit monitoring and fraud assistance through Cyberscout.

What You Should Do

• Organizations running Oracle EBS versions 12.2.3 through 12.2.14 must verify that the October 2025 emergency patch for CVE-2025-61882 is fully applied.
• Conduct thorough audits of logs for any suspicious activity related to BI Publisher, particularly dating back to mid-2025.
• Immediately rotate all credentials associated with EBS integrations.
• Affected individuals should proactively monitor credit reports, enable fraud alerts with credit bureaus, and exercise extreme caution regarding any unsolicited communications, particularly phishing attempts that reference the data breach.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.