JCPenney, Catalyst Brands and Authentic Brands Group: JCPenneyData Breach?

JCPenney Investigates Alleged Data Breach by ShinyHunters

On June 12, 2026, the ransomware group ShinyHunters claimed to have breached JCPenney, potentially exposing hundreds of thousands of sensitive records. According to a post on the dark web intelligence platform Ransomware.live, the stolen data may include Social Security numbers, dates of birth, W-2 forms, payroll information, and scans of government-issued IDs.

The breach appears to extend beyond JCPenney, affecting other subsidiaries of Catalyst Brands and Authentic Brands Group. Legal teams are investigating whether the incident stemmed from a vulnerability in Oracle PeopleSoft applications, which could have been exploited by the threat actors.

At the time of reporting, JCPenney had not confirmed the breach, and no official statement had been released. However, attorneys are actively seeking current and former employees, as well as affected individuals, to determine if a class action lawsuit can be filed. The investigation aims to assess potential damages, including loss of privacy, financial costs, and time spent mitigating the breach’s impact.

ShinyHunters, a known cybercriminal group, has previously targeted major organizations, and this incident follows a pattern of high-profile data theft. Further details remain unconfirmed as the investigation continues.

Source: https://www.classaction.org/data-breach-lawsuits/jcpenney-june-2026

JCPenney cybersecurity rating report: https://www.rankiteo.com/company/jcpenney

Authentic Brands Group cybersecurity rating report: https://www.rankiteo.com/company/authentic-brands-group

Catalyst Brands cybersecurity rating report: https://www.rankiteo.com/company/catalystbrands

"id": "JCPAUTCAT1781735087",
"linkid": "jcpenney, authentic-brands-group, catalystbrands",
"type": "Ransomware",
"date": "6/2026",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Current and former employees, '
                                              'affected individuals',
                        'industry': 'Retail',
                        'name': 'JCPenney',
                        'type': 'Retail'},
                       {'name': 'Catalyst Brands', 'type': 'Subsidiary'},
                       {'name': 'Authentic Brands Group',
                        'type': 'Subsidiary'}],
 'attack_vector': 'Vulnerability Exploitation',
 'data_breach': {'data_exfiltration': 'Yes',
                 'number_of_records_exposed': 'Hundreds of thousands',
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Social Security numbers',
                                              'Dates of birth',
                                              'W-2 forms',
                                              'Payroll information',
                                              'Scans of government-issued '
                                              'IDs']},
 'date_detected': '2026-06-12',
 'date_publicly_disclosed': '2026-06-12',
 'description': 'On June 12, 2026, the ransomware group ShinyHunters claimed '
                'to have breached JCPenney, potentially exposing hundreds of '
                'thousands of sensitive records, including Social Security '
                'numbers, dates of birth, W-2 forms, payroll information, and '
                'scans of government-issued IDs. The breach may also affect '
                'other subsidiaries of Catalyst Brands and Authentic Brands '
                'Group. Legal teams are investigating whether the incident '
                'stemmed from a vulnerability in Oracle PeopleSoft '
                'applications.',
 'impact': {'data_compromised': 'Hundreds of thousands of records',
            'identity_theft_risk': 'High',
            'legal_liabilities': 'Potential class action lawsuit',
            'systems_affected': 'Oracle PeopleSoft applications'},
 'investigation_status': 'Ongoing',
 'motivation': 'Data Theft',
 'ransomware': {'data_exfiltration': 'Yes'},
 'references': [{'date_accessed': '2026-06-12', 'source': 'Ransomware.live'}],
 'regulatory_compliance': {'legal_actions': 'Potential class action lawsuit'},
 'threat_actor': 'ShinyHunters',
 'title': 'JCPenney Alleged Data Breach by ShinyHunters',
 'type': 'Data Breach',
 'vulnerability_exploited': 'Oracle PeopleSoft applications'}