Parexel International says it learned that files containing employee personal information were exposed as part of a broader security incident affecting Oracle, a third-party vendor that hosted a portion of Parexel’s Oracle OCI E-Business Suite environment. According to the letter, Parexel detected suspicious activity on October 4, 2025, and its investigation traced the cause to a zero-day exploit in Oracle’s cloud infrastructure that Oracle publicly disclosed on October 5, 2025. Parexel states it was one of many Oracle customers affected, that the incident was limited to the vendor’s environment, and that there is no evidence its own internal network or systems were compromised. This is a third-party vendor breach, and Parexel says it disconnected the affected system, applied Oracle’s patch, and reviewed the exposed files to determine whose information was involved.
The notice is directed at individuals whose personal data was included in files Parexel had stored with Oracle in connection with their employment. Parexel has not stated a total number of affected individuals in the portion of the letter provided.
What information was exposed?
- Full name
- Date of birth
- Financial account number and/or payment card number (without the CVV)
- Social Security number and/or national ID number
Parexel is offering 24 months of complimentary identity monitoring and theft resolution services through IDX. To enroll, visit https://app.idx.us/account-creation/protect and use the Enrollment Code printed at the top of your letter, or call 1-844-958-0908. The enrollment deadline is March 17, 2026.
What should you do now?
- Enroll in the free 24-month IDX identity monitoring service before the March 17, 2026 deadline, and make sure to activate the credit monitoring feature once you sign up — it does not start automatically.
- Because your Social Security number and financial account information were involved, consider placing a security freeze with Equifax, Experian, and TransUnion, which prevents new accounts from being opened in your name without your permission.
- Place a fraud alert with one of the three credit bureaus; once one bureau is notified, it will alert the other two on your behalf.
- Request your free annual credit reports at www.annualcreditreport.com and review them closely for accounts or inquiries you don’t recognize.
- Watch your bank and credit card statements closely for unfamiliar charges, and report anything suspicious to your financial institution right away.
- For ongoing peace of mind, consider signing up for a service like Aura or LifeLock, which can alert you if your information appears elsewhere, such as on the dark web.
- If you spot signs of misuse, file a report at www.identitytheft.gov or call the FTC at 1-877-438-4338 to get a personalized recovery plan.
If you have questions or need to activate your complimentary monitoring, Parexel’s dedicated support team can be reached at 1-844-958-0908, available 9 a.m. to 9 p.m. ET, Monday through Friday, excluding major U.S. holidays.