Bimbo Bakeries USA: Oracle E-Business Suite Zero-Day Data Theft

Bimbo Bakeries USA, one of the largest commercial baking companies in the United States and the operator of brands including Thomas', Entenmann's, Sara Lee, Ball Park, Arnold, Brownberry and Oroweat, has confirmed that attackers exploited a zero-day vulnerability in Oracle's E-Business Suite (EBS) to acquire files from its environment, and that at least one of those files contained individuals' names and Social Security numbers. The confirmation comes directly from the company's own breach notification letter, dated August 31, 2026 and filed with the California Attorney General's office on September 4. The timeline in that letter is the most striking detail: Bimbo determined on December 6, 2025 that files had been taken, but did not identify the file containing names and SSNs until August 19, 2026, a gap of 256 days. The company has not stated how many people were affected, has not said when the intrusion actually began, and has not attributed the attack to any threat group.

What Happened

According to Bimbo Bakeries' own notice, the company learned of a zero-day vulnerability in Oracle E-Business Suite, immediately applied the patches Oracle provided, and launched an investigation. That investigation determined on December 6, 2025 that the zero-day had allowed unauthorized parties to acquire files stored in the EBS application. A subsequent document review to determine what was actually in those files ran for roughly eight more months before producing the August 19, 2026 finding that a file contained affected individuals' names and Social Security numbers.

Notably, Bimbo frames the event as an incident "that involved our third-party vendor, Oracle," and says its remediation step is to re-evaluate its vendor relationships. That framing is worth flagging: the company's letter describes no containment or hardening measures for its own EBS deployment beyond patching, and no detection or monitoring improvements.

CyberInsider, which first reported the filing, connects the disclosure to the broader Oracle EBS exploitation campaign that began in August 2025 and has been widely tied to the Clop extortion brand. That linkage is an inference drawn from timing and product, not something Bimbo has confirmed. The company has not named Clop, has not said whether it received an extortion demand, and has not identified which CVE was involved. Treat the Clop connection as plausible and consistent with the campaign timeline, not as established fact in this specific case.

What Was Taken

The confirmed data categories are narrow and severe: name plus Social Security number. That combination is the core input for identity theft, synthetic identity fraud, fraudulent tax filings and credit applications, and it does not expire or rotate the way a password or payment card does.

On volume, the sources are silent rather than contradictory. Bimbo's notification letter is an individual notice and states no aggregate figure; CyberInsider explicitly notes that the company "has not revealed the total number of affected individuals." No source in this set provides a record count, so any number circulating for this incident is not supported by the primary filing. Given that Oracle EBS is the system of record for finance, HR, payroll and procurement at large enterprises, and given Bimbo's scale as a national baking operation, the population at risk is plausibly large, but that is an inference about exposure, not a confirmed count.

Bimbo is offering 12 months of single-bureau credit monitoring, credit report and credit score services, plus fraud remediation assistance, through Cyberscout, a TransUnion company. Twelve months of single-bureau monitoring is a thin remedy against a permanent SSN compromise.

Why It Matters

The strategic lesson here is not "patch faster." Bimbo says it patched as soon as it learned of the vulnerability. The damage was already done by then, which is exactly the pattern the Oracle EBS campaign has demonstrated repeatedly. Penligent's analysis of CVE-2025-61882 makes the point sharply: for organizations that ran internet-accessible EBS infrastructure during the exploitation window, the operative question is not "have we installed the patch" but "was the environment compromised before we installed it."

The second lesson is forensic readiness. The 256-day gap between confirming that files were stolen and determining that one of them contained SSNs is the real failure mode. During that window, affected employees had no idea their identity data was in criminal hands and took no protective action. NHI Management Group's write-up of the campaign, citing Anomali, names this directly: the problem is not only patch latency but exposure window management, forensic readiness, and the mistaken assumption that no ransom contact means no compromise. Bimbo's own letter is evidence of how long content review takes when an organization cannot quickly answer what was in the files an ERP system was holding.

Third, EBS compromise is an identity problem, not just an application problem. Once an attacker reaches application-level code execution in an ERP platform, they reach stored credentials, service integrations and privileged workflows. Identity governance belongs inside incident containment, not downstream of it.

The Attack Technique

Bimbo has not named the vulnerability used against it. The sources describe several relevant Oracle attack paths, and they should not be collapsed into one.

CVE-2025-61882 is the flaw most associated with the campaign Bimbo's incident is being linked to. Oracle disclosed it on October 4, 2025. It carries a CVSS 3.1 score of 9.8 and allows unauthenticated remote code execution over HTTP with no user interaction, leading to takeover of Oracle Concurrent Processing via the BI Publisher Integration component. Note a discrepancy in affected-version ranges across the sources: Penligent and NHI Management Group both cite Oracle EBS 12.2.3 through 12.2.14 for this CVE, while SentinelOne's entry for a separate flaw cites 12.2.3 through 12.2.15. Penligent, citing Google Threat Intelligence Group and Mandiant, reports that exploitation as a zero-day may date to August 9, 2025, with suspicious EBS activity observed as far back as July 2025, weeks to months ahead of Oracle's emergency patch. Indicators were subsequently added to CISA's Known Exploited Vulnerabilities catalog.

CVE-2026-70680 is a more recent and distinct issue, published to the NVD on August 18, 2026 and documented by SentinelOne. It is an improper access control flaw (CWE-284) in the Internal Operations component of Oracle Applications DBA, affecting EBS 12.2.3 through 12.2.15. It requires low-privileged network access over HTTP, grants unauthorized read access to all data reachable by Applications DBA, and permits a partial denial of service. Its publication date falls well after Bimbo's December 2025 determination, so it is not a candidate for this intrusion, but it is a live exposure for anyone still running affected versions.

The Huntress "khunt" case is a separate incident and should not be read as Bimbo's attack path. Huntress disclosed on August 5, 2026 that on July 27, 2026 it responded to credential theft on an endpoint hosting an Oracle database server at an unnamed organization. Initial access came from ordinary SQL injection through an autocomplete search feature in a public-facing application, which reached PL/SQL and then the operating system. The attacker then used Oracle's CREATE JAVA SOURCE functionality and the embedded Oracle JVM to upload, compile and run a post-exploitation toolkit called khunt directly inside the database as schema objects, including khuntCmd and khuntHash for OS command execution and credential dumping. The operators copied the SAM, SECURITY and SYSTEM registry hives, likely for exfiltration. CSO Online reports the chain reached SYSTEM-level access on the underlying Windows host. The Register's coverage adds the uncomfortable framing: Oracle's late-July 2026 patch dump ran to 1,449 patches, and per Craig Savage of Spinnaker Support, none of them would have stopped this attack. "Even if it had been fully patched, everything working, it still would have happened."

Taken together, these are two different failure classes against the same vendor stack: an unauthenticated zero-day in an internet-facing ERP application, and abuse of legitimate database functionality reached through a decades-old input-handling bug. Neither is solved by patch cadence alone.

What Organizations Should Do

1. Assume pre-patch compromise on internet-facing EBS. If your Oracle E-Business Suite instance (particularly 12.2.3 through 12.2.15) was reachable over HTTP at any point from July 2025 onward, treat patching as insufficient and run a retrospective compromise assessment covering the full exposure window, not just the period after remediation.
2. Fix the content-review bottleneck before you need it. Bimbo's 256-day gap between "files were taken" and "the files contained SSNs" is the avoidable part of this incident. Maintain a current data inventory for ERP, HR and payroll systems so you can answer what was in a compromised file store in weeks, not quarters, and notify affected people accordingly.
3. Patch CVE-2026-70680 and audit Applications DBA access. The August 2026 access-control flaw requires only low-privileged network access to read everything the Applications DBA component can reach. Review who holds low-privilege EBS credentials and whether the Internal Operations endpoints need to be reachable at all.
4. Lock down the Oracle embedded JVM. Restrict CREATE JAVA SOURCE and equivalent Java privileges to accounts that genuinely need them, alert on Java source objects being created or compiled in production databases, and monitor for database-initiated OS command execution. The khunt case shows this path is being actively used and is invisible to patch-based defenses.
5. Treat database service accounts as identity assets. Application-level RCE becomes credential theft fast. Rotate ERP and database service credentials after any suspected compromise, remove stored plaintext credentials from EBS-adjacent systems, and watch for registry hive access on database hosts.
6. Do not read silence as safety. No extortion contact does not mean no exfiltration. Build detection around outbound data volume from ERP hosts and validate it against a known-good baseline rather than waiting for a leak site listing.
7. Push vendor risk beyond re-evaluation. Bimbo's stated remedy is to re-evaluate vendor relationships. That is not a control. Ask vendors for exploitation-window telemetry, virtual-patching options, and contractual forensic support commitments before the next zero-day lands.

Sources: Bimbo Bakeries confirms data stolen in Oracle EBS zero-day attack | PDF Jonathan Berger | CVE-2026-70680: Oracle E-Business Suite Auth Bypass Flaw | Inside an Oracle Database SQL Injection Attack Huntress | You could've applied all 1,449 Oracle patches and still been hit by... | Attackers hid malware inside Oracle Database after SQL injection br... | Oracle E-Business Suite zero-day exploitation exposes patch blind s... | CVE-2025-61882: Oracle E-Business Suite RCE and CL0P Exploitation E...