JCPenney

Summary

A cybercrime group known as ShinyHunters claimed to have stolen a large volume of records from JCPenney and Catalyst Brands, including Social Security numbers, dates of birth, W-2 tax forms, payroll records, driver's licenses, government-issued ID scans, and other personally identifiable information. The companies learned of the breach and a national class action law firm launched an investigation into potential claims arising from the exposure. Individuals whose data was compromised may face an increased risk of identity theft and fraud.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On or about June 12, 2026, JCPenney and Catalyst Brands became aware of a cybersecurity incident affecting their systems. The company disclosed that a cybercrime group known as ShinyHunters claimed to have stolen a large volume of records and threatened to publish the information unless the companies responded. ShinyHunters allegedly communicated the threat through a public statement, demanding a response from the companies to prevent the release of the stolen data. A press release announcing the investigation was issued on June 18, 2026.

JCPenney and Catalyst Brands confirmed that the compromised data may include Social Security numbers, dates of birth, W-2 tax forms, payroll records, driver's licenses, government-issued ID scans, and other personally identifiable information. Individuals who received a data breach notification from the companies were identified as potentially facing an increased risk of identity theft and fraud. The exposure of such sensitive information raised concerns about misuse for fraudulent activities.

In response to the incident, the national class action law firm Edelson Lechtzin LLP launched an investigation into the exposure of personal information and began evaluating potential claims on behalf of affected individuals. The firm stated that it would offer free case evaluations to those wishing to explore legal remedies related to the breach. JCPenney is described as a U.S. department store retailer that sells clothing, home products, beauty items, and services including salons and optical care, and operates under Catalyst Brands and Authentic Brands Group.

Sources

Sources available to members: 1 source.