Catalyst Brands, the retail parent company of JCPenney and other national apparel brands, disclosed a cybersecurity incident affecting a third-party vendor supporting its HR and payroll services. The breach occurred on or around May 26, 2026, and was confirmed by the company on August 5, 2026. This incident led to the exposure of employee personal information.
The exposed data includes names, Social Security numbers, dates of birth, driver’s license numbers, passport numbers, Alien Registration numbers, U.S. military or other government-issued identification numbers, contact information, home addresses, financial account numbers, email, usernames with passwords or security answers, digital signatures, payroll records, and W-2 tax forms. One source reported that 368,418 records were exposed.
Details such as when regulators or consumers were notified have not been publicly confirmed. Additional information may emerge as investigations continue and as legal proceedings progress.