Almeida Law Group is investigating a data breach at Catalyst Brands LLC. The breach occurred on May 20th, 2026. If you were affected, contact Almeida Law Group.
About Catalyst Brands LLC
Catalyst Brands LLC, formerly Penney OpCo LLC, is an operator, retailer, and distributor of apparel and accessories headquartered in Plano, Texas. Formed in 2025 through the merger of Sparc Group and JCPenney, it is jointly owned by Brookfield Corporation and Simon Property Group. Its subsidiaries include JCPenney, Brooks Brothers, Lucky Brand Jeans, Nautica, and Aéropostale. The company has approximately 60,000 employees and reported revenue of approximately $9 billion. Because the breach involved a third-party system supporting HR and payroll services, the exposed information is particularly sensitive — including Social Security numbers, financial account numbers, and government-issued identification data.
What Happened?
Catalyst Brands LLC was listed in a California Attorney General sample breach notice filed on September 4th, 2026. According to the company’s own breach notice, Catalyst Brands became aware of a cybersecurity incident on or around May 26th, 2026, involving unauthorized access to certain servers managed by a third-party vendor that supports its HR and payroll-related services. The company determined on August 5th, 2026, that an unauthorized third party had obtained personal information in connection with this incident. The breach is recorded as having occurred on May 20th, 2026. The total number of persons affected was not specified in the filing. The types of information involved varied by individual and included first and last name, Social Security number, date of birth, driver’s license number, passport number, Alien Registration number (A-number), U.S. military identification number or other government-issued identification number, contact information, financial account number (without access information), email or username with password or security answer, and digital signature. Catalyst Brands is offering 24 months of Experian IdentityWorks credit monitoring at no cost to affected individuals, with an enrollment deadline of December 31st, 2026.
Separately, on June 12th, 2026, threat actor group ShinyHunters claimed on its leak site to have stolen hundreds of thousands of records from JCPenney and other subsidiaries under Catalyst Brands. ShinyHunters allegedly threatened to publish the data if companies did not respond by June 15th, 2026. However, ShinyHunters did not release data samples to verify the claim, and the scope and authenticity of that claim remained unconfirmed. The company’s own breach notice does not reference ShinyHunters, and no independent source definitively links or separates the two incidents. Law firm Edelson Lechtzin LLP announced on June 18th, 2026, that it is investigating potential class action claims on behalf of affected individuals, and ClassAction.org has also announced an investigation. No filed class action lawsuit was found in search results as of September 4th, 2026.
Key Facts at a Glance
- Company or Organization: Catalyst Brands LLC
- Industry: Apparel and accessories retail
- Location: Plano, Texas
- Incident type: Unauthorized access to third-party HR and payroll vendor servers
- Date of breach: May 20th, 2026
- Date breach discovered: May 26th, 2026
- Date of consumer notification: September 4th, 2026
- Identity theft protection offered: 24 months of Experian IdentityWorks (no cost)
- Enrollment deadline: December 31st, 2026
- Litigation status: Law firm investigations announced; no filed class action as of September 4th, 2026
- Source: California Attorney General — Breach Report sb24-629314; Cybernews — ShinyHunters JCPenney Claim; PR Newswire / Edelson Lechtzin LLP — Class Action Investigation; Wikipedia — Catalyst Brands
What Should You Do?
If you received a notice from Catalyst Brands LLC, enroll in the complimentary 24-month Experian IdentityWorks membership before the December 31st, 2026, deadline at experianidworks.com/1Bcredit. Because the breach involved Social Security numbers, financial account numbers, and other highly sensitive identifiers, you should also consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion. Monitor your financial accounts and credit reports closely, and obtain your free annual credit reports at AnnualCreditReport.com. If you suspect your information has been misused, visit IdentityTheft.gov to report identity theft and get a personalized recovery plan.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
