Catalyst Brands

Disclosed Sep 4, 2026187,341 affectedConfirmed

Catalyst Brands employee data stolen from third-party HR and payroll servers

Catalyst Brands, owner of JCPenney, Brooks Brothers and other retail brands, said attackers accessed servers run by a third party supporting its HR and payroll services, obtaining SSNs, ID and passport numbers, financial account numbers and login details.

What is known

People affected	187,341 (as reported by the organization)
Disclosed	Sep 4, 2026
Discovered	May 26, 2026
Happened	May 20, 2026
Attack	Vendor breach
Data exposed	NamesSocial Security numbersDates of birthGovernment IDsFinancialCredentials and tokensEmailsEmploymentPayment cardsAddresses
Sector	Retail · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Catalyst Brands

Official noticeatg.wa.gov

Washington Attorney General breach notice: Catalyst Brands

Official noticejustice.oregon.gov

Oregon DOJ breach notice: Catalyst Brands

Regulatoroag.ca.gov

California AG breach report: Catalyst Brands

Regulatoroag.ca.gov

Catalyst Brands sample notice

Official noticeoag.my.site.com

Texas Attorney General data security breach report BR-0005314: Catalyst Brands

Official noticeago.vermont.gov

Vermont Attorney General breach report: Catalyst Brands

Official noticein.gov

Indiana Attorney General 2026 data breach report: Catalyst Brands

Notices filed

Residents of CASep 4

California AGCount not stated

Residents of WASep 4

Washington AG4,015 people

Residents of ORSep 4

Oregon DOJ187,341 people

TotalSep 4

ResearchCount not stated

Residents of VTSep 4

Vermont AG234 people

Residents of INSep 4

Indiana AG4,131 people

Residents of TXSep 9

Texas AG24,403 people

History of this record

source2026-10-02

empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-October-Year-to-Date-Report-2026.pdfby dailySource

source2026-09-25

empty to https://ago.vermont.gov/categories/security-breach-noticesby backfillSource

data_types2026-09-25

["names","ssn","dob","government-id","financial","credentials","emails","employment"] to ["names","ssn","dob","government-id","financial","credentials","emails","employment","payment-card","addresses"]by backfillSource

records_basis2026-09-25

empty to organizationby backfillSource

records2026-09-25

empty to 187341by backfillSource

attack2026-09-25

hacking to third-partyby seedSource

data_types2026-09-25

[] to ["names","ssn","dob","government-id","financial","credentials","emails","employment"]by seedSource

summary2026-09-25

empty to Catalyst Brands, owner of JCPenney, Brooks Brothers and other retail brands, said attackers accessed servers run by a third party supporting its HR and payroll services, obtaining SSNs, ID and passport numbers, financial account numbers andby seedSource

title2026-09-25

empty to Catalyst Brands employee data stolen from third-party HR and payroll serversby seedSource

attack2026-09-25

unknown to hackingby backfillSource

discovered2026-09-25

empty to 2026-05-26by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Catalyst Brands