The Estée Lauder Companies disclosed a data breach on July 10, 2026, which occurred on July 2, 2026. The company reported this incident to the Vermont Attorney General under the state’s Security Breach Notice Act. The official company statement as of July 10 indicated that further information about the nature or scope of the breach was unavailable. The breach involved approximately 2.7 million individuals. The exposed data types include Social Security numbers, financial account codes, credit/debit information, government ID numbers, and health records. The full scope of affected states is not yet specified, but notifications were likely sent to all affected U.S. residents. Details surrounding the breach can still emerge, and the timeline for notifications may be delayed as investigations continue.