Employee data at US-based cosmetics firm Estée Lauder was compromised through a vulnerability in Oracle's software, likely orchestrated by the Cl0p ransomware gang.