JCPenney and Catalyst Brands Data Breach Exposes Sensitive Customer Information

• •JCPenney and Catalyst Brands experienced a significant data breach on June 12, 2026.
• •The breach involved a cybercrime group called ShinyHunters, which threatened to publish stolen data.
• •Sensitive information exposed includes Social Security numbers and W-2 tax forms.

On June 12, 2026, JCPenney and Catalyst Brands reported a data breach involving a cybercrime group known as ShinyHunters. The breach potentially exposed sensitive personal information, including Social Security numbers, dates of birth, W-2 tax forms, and driver's licenses. Edelson Lechtzin LLP has initiated an investigation into the breach and is offering free case evaluations for affected individuals. Those impacted may face increased risks of identity theft and fraud. The law firm is considering a class action lawsuit to address the claims of individuals whose data was compromised. Customers are advised to monitor their accounts and consider placing fraud alerts. The breach highlights ongoing vulnerabilities in data security for major retailers.