Bimbo Bakeries USA reported a data security incident involving its third-party vendor, Oracle. The incident involved a zero-day vulnerability in Oracle’s E-Business Suite application. Bimbo Bakeries USA’s California notification states that the breach occurred on August 9, 2025, and that unauthorized parties acquired files stored in the application on December 6, 2025. The company filed a breach notification with the California Attorney General, and reports indicate that affected individuals began receiving notices on August 19, 2026.
Bimbo Bakeries USA stated that its review identified files containing names and Social Security numbers. The total number of affected individuals has not been publicly disclosed in the sources reviewed. The California notification states that 51 Rhode Island residents were affected. The available sources do not identify medical information, bank account information, or payment card information. Further details may emerge as notices and regulatory filings are updated.