JCPenney Data Breach (June 2026)
JCPenney, the Plano, Texas department store chain, was targeted in a ShinyHunters pay or leak extortion campaign in June 2026. Have I Been Pwned has verified 368,418 records, which it says primarily relate to current and former employees, holding names, dates of birth, government issued IDs, contact details, job titles and usernames.
- Organization
- JCPenney
- Sector
- Retail
- Country
- United States, TX
- Incident date
- June 12, 2026
- Disclosed
- June 20, 2026
- Records affected
- 368,000
- Attack type
- Undisclosed
- Threat actor
- ShinyHunters
- Status
- Confirmed
- Dates of birth
- Email addresses
- Government issued IDs
- Job titles
- Names
- Phone numbers
- Physical addresses
- Usernames
- ShinyHunters adds JCPenney and several brands associated with Catalyst Brands and Authentic Brands Group to its leak site, claiming hundreds of thousands of stolen records, per Cybernews. Have I Been Pwned gives the same date as the breach date.
- The group's listing sets this date as the deadline for the companies to make contact before the data is released, per Cybernews, and Money reports that JCPenney has not publicly responded to the claim.
- Have I Been Pwned loads the verified records, covering 368,418 email addresses, per its entry.
What Happened
Per the Have I Been Pwned entry, JCPenney and associated brands were targeted in a ShinyHunters pay or leak extortion campaign in June 2026, and data said to have come from JCPenney was later published. The entry says the data was allegedly obtained through the exploitation of a critical zero-day vulnerability in Oracle PeopleSoft, and that the records primarily related to internal HR systems and affected current and former employees. It counts 368,418 records covering corporate and personal email addresses, names, dates of birth, Social Security numbers, phone numbers and home addresses.
In a June 12, 2026 report, Cybernews senior journalist Paulina Okunytė wrote that the group had added JCPenney and several brands associated with Catalyst Brands and Authentic Brands Group to its leak site. According to Cybernews, the listing claimed "hundreds of thousands" of stolen records, gave the companies until June 15 to make contact before the data was released, and said the dataset held Social Security numbers, dates of birth, W-2 tax forms, payroll records, driver's licenses and scans of government issued IDs. The report said no data samples had been released at that point.
Money's weekly scam alert of June 15, 2026, by Gabriel O. Rodriguez Cruz, reported that JCPenney had not publicly responded to the claim, and said it was not yet clear whether the stolen data affected only employees and former employees or customers as well. Have I Been Pwned loaded the verified records on June 20, 2026.
What Was Exposed
8 classes of data across 368,418 records, per Have I Been Pwned, JCPenney breach entry: dates of birth, email addresses, government issued IDs, job titles, names, phone numbers, physical addresses and usernames.
Social Security numbers and dates of birth beside names and home addresses are the core inputs for opening credit in someone's name, and job titles with corporate email addresses let a fraudster pose as HR or payroll to current and former staff.
What to Do If You Are Affected
The full sequence, and what to do in what order, is in what to do after a data breach.
What Is Not Known Yet
Catalyst Brands, the company JCPenney is part of, filed data breach notices with state attorneys general dated September 4, 2026, describing unauthorized access to servers managed by a third party that supports its HR and payroll-related services, on or around May 20, 2026. The notices do not mention JCPenney, ShinyHunters or Oracle PeopleSoft, so whether they describe this incident is an open question. Have I Been Pwned describes the PeopleSoft route as alleged, and Money reported on June 15 that it was not yet clear whether customer data was included alongside employee records.
Sources
- Have I Been Pwned, JCPenney breach entry
- Cybernews, "ShinyHunters claim JCPenney retail data theft involving SSNs and payroll files", June 12, 2026
- Money, "Weekly Scam Alert: JCPenney Hack Allegedly Exposed Social Security Numbers", June 15, 2026
- California Attorney General, Catalyst Brands LLC data breach notification, September 4, 2026
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.