An Oracle flaw let attackers take Social Security numbers. Bimbo Bakeries confirmed it.
Bimbo Bakeries USA has confirmed that files holding names and Social Security numbers were taken out of its Oracle E-Business Suite environment, CyberInsider reported on Monday.
CyberInsider names the vulnerability used as CVE-2025-61882, an unauthenticated remote code execution flaw in the BI Publisher Integration component of Oracle E-Business Suite, rated 9.8 on the CVSS scale. Oracle published a patch and the company applied it.
Then read the dates in the filing. Bimbo Bakeries determined on 6 December 2025 that unauthorized parties had acquired files. It identified the file holding names and Social Security numbers on 19 August 2026. The letter to affected people went out on 31 August, and the notice reached the California Attorney General on 4 September.
From 6 December to 19 August is 256 days between knowing that something left and knowing what was in it.
The company has not said how many people are affected. It is offering 12 months of credit monitoring through Cyberscout. CyberInsider notes the Clop group has been tied to the wider Oracle E-Business Suite campaign, and that Bimbo Bakeries has not attributed this attack to anyone.
How long would it take you to say exactly which records left your own ERP?
Sources
Our file on Oracle
- 5 Nov
Oracle dropped an estimated $7 billion deal to rent AI chips to Tencent, the FT reported. US officials had raised concerns.
- 3 Nov
Oracle set a $20 billion limit on new borrowing until 2030. A week later it offered bonds worth half that limit.
- 3 Nov
Oracle NetSuite user Brennan Industries says AI builds up to five ERP apps a day. ERP architects maintain that code.
- 2 Nov
Microsoft, Oracle and three peers cut buybacks 83% to $13.6bn. AI spending is eating their cash, a Reuters analysis found.
- 2 Nov
Erasmus University's move from SAP to Oracle is 70% over budget, at €20.2m. A one-year delay cost €4.5m of that.
Every story here is open to read. The ERP LEADERS brief goes one step further.
The day in enterprise software, in one email: the stories that matter, the failures with their figures, one case taken apart. Read a sample or sign up for the brief.
Welcome back. · Issue 01
