Maritz Holdings, a company that runs customer loyalty and employee reward programs on behalf of other businesses, has sent letters informing certain individuals that their personal information was caught up in a cybersecurity incident tied to a previously unknown flaw in Oracle’s E-Business Suite (EBS) software. According to the letter, Maritz uses Oracle EBS internally for finance work like invoicing and issuing payments. When Oracle disclosed a vulnerability in the platform in October 2025, Maritz investigated and found that an unauthorized third party had already gotten into its Oracle EBS environment and pulled files between August 10 and August 13, 2025 — before the vulnerability was even made public. That timing matters: it means whoever accessed the system was exploiting a flaw nobody outside the attacker knew existed yet.
