Catalyst Brands
Disclosed Sep 4, 20263 weeks ago187,341 affectedConfirmed
Catalyst Brands employee data stolen from third-party HR and payroll servers
Catalyst Brands, owner of JCPenney, Brooks Brothers and other retail brands, said attackers accessed servers run by a third party supporting its HR and payroll services, obtaining SSNs, ID and passport numbers, financial account numbers and login details.
What is known
| People affected | 187,341 (as reported by the organization) |
|---|---|
| Disclosed | Sep 4, 2026 |
| Discovered | May 26, 2026 |
| Happened | May 20, 2026 |
| Attack | Vendor breach |
| Data exposed | Names, Social Security numbers, Dates of birth, Government IDs, Financial, Credentials and tokens, Emails, Employment, Payment cards, Addresses |
| Sector | Retail · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Catalyst Brandsoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Catalyst Brandsatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Catalyst Brandsjustice.oregon.gov · Official notice | Official notice |
| California AG breach report: Catalyst Brandsoag.ca.gov · Regulator | Regulator |
| Catalyst Brands sample noticeoag.ca.gov · Regulator | Regulator |
| Texas Attorney General data security breach report BR-0005314: Catalyst Brandsoag.my.site.com · Official notice | Official notice |
| Vermont Attorney General breach report: Catalyst Brandsago.vermont.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Sep 4 | |
| Washington AGresidents of WA | Sep 4 | 4,015 |
| Oregon DOJresidents of OR | Sep 4 | 187,341 |
| Researchtotal | Sep 4 | |
| Vermont AGresidents of VT | Sep 4 | 234 |
| Texas AGresidents of TX | Sep 9 | 24,403 |
History of this record
- 2026-09-25 · source: empty to https://ago.vermont.gov/categories/security-breach-notices · backfill source
- 2026-09-25 · data_types: ["names","ssn","dob","government-id","financial","credentials","emails","employment"] to ["names","ssn","dob","government-id","financial","credentials","emails","employment","payment-card","addresses"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 187341 · backfill source
- 2026-09-25 · attack: hacking to third-party · seed source
- 2026-09-25 · data_types: [] to ["names","ssn","dob","government-id","financial","credentials","emails","employment"] · seed source
- 2026-09-25 · summary: empty to Catalyst Brands, owner of JCPenney, Brooks Brothers and other retail brands, said attackers accessed servers run by a third party supporting its HR and payroll services, obtaining SSNs, ID and passport numbers, financial account numbers and · seed source
- 2026-09-25 · title: empty to Catalyst Brands employee data stolen from third-party HR and payroll servers · seed source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2026-05-26 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.