Bimbo Bakeries USA Data Breach Exposes SSNs in Oracle E-Business Suite Zero-Day Attack

Bimbo Bakeries USA (BBU) has revealed that attackers gained access to files containing names and Social Security numbers by exploiting a zero-day vulnerability in Oracle E-Business Suite (EBS), which a third-party vendor uses.

The company confirmed the unauthorized access in December 2025 but did not identify the existence of Social Security numbers until August 2026.

Bimbo Bakeries USA Data Breach

In notices dated August 31, BBU stated that it applied patches provided by Oracle after learning about the zero-day vulnerability and initiated an investigation.

The investigation, completed on December 6, 2025, confirmed that unauthorized parties had obtained files stored in the affected Oracle EBS application. Following this, BBU reviewed the files to determine their contents.

On August 19, 2026, this review revealed a file containing the names and Social Security numbers of each affected individual.

However, BBU did not disclose how many people were affected, the volume of data compromised, the initial access point, or whether the intruders accessed systems beyond the EBS environment.

Additionally, the company did not publicly attribute the intrusion to any specific group or indicate whether it had received an extortion demand.

BBU is reassessing its vendor relationships and has offered those affected 12 months of single-bureau credit monitoring, credit reports, credit score services, and fraud assistance through Cyberscout.

Their notification advises individuals to review their account activity and credit reports. It explains how to set up fraud alerts and security freezes.

BBU’s notification did not specify a CVE (Common Vulnerabilities and Exposures) number. However, the timeline and the affected application are consistent with the Oracle EBS campaign associated with CVE-2025-61882.

An emergency patch released by Oracle in October 2025 addressed this critical flaw, which impacted EBS versions 12.2.3 to 12.2.14 and allowed unauthenticated remote code execution.

The Google Threat Intelligence Group (GTIG) indicated that exploitation likely began in August 2025, before the patch became available. Researchers later tracked a large-scale extortion operation associated with the CL0P brand.

However, they cautioned that branding alone is not sufficient for definitive attribution. BBU has not confirmed a link to CL0P; any association remains contextual rather than definitively established.

GTIG observed exploitation via a POST request to /OA_HTML/SyncServlet, followed by the creation of a malicious EBS database template and its execution in Template Preview.

Indicators for investigation include TemplateCode values that begin with TMP or DEF, particularly for XSL-TEXT or XML template types. Researchers also detected Java-based, in-memory payloads, including GOLDVEIN.JAVA and the SAGEGIFT, SAGELEAF, and SAGEWAVE chains.

Oracle EBS operators should not consider patching as complete remediation. It is essential to confirm that emergency fixes and prerequisite Critical Patch Updates are installed.

Operators should investigate historical logs for SyncServlet, UiServlet, and TemplatePreviewPG requests and review the XDO_TEMPLATES_B and XDO_LOBS for any new or anomalous templates. Restricting non-essential internet access from EBS servers can disrupt payload retrieval or data exfiltration.

The BBU case highlights the third-party risks associated with platforms that hold sensitive workforce data. Organizations should conduct an inventory of vendor-hosted EBS deployments, establish log retention and forensic access requirements, test notification processes for prolonged data review periods following an incident, and validate those procedures with third-party incident response exercises.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.