Catalyst Brands Data Breach Exposes W-2 Information

Catalyst Brands LLC, the retail holding company behind JCPenney, Brooks Brothers, Aéropostale, Eddie Bauer, Lucky Brand and Nautica, disclosed a data breach that exposed sensitive personal information.

The breach was reported to the California Attorney General on Sept. 4, 2026. Catalyst Brands mailed notification letters to affected individuals on Sept. 4, 2026.

A ransomware attack struck servers used for Catalyst Brands' HR and payroll-related services on May 20, 2026. The company became aware of the unauthorized access on or around May 26, 2026.

On June 12, 2026, a hacking group known as ShinyHunters posted a claim on the Tor network stating it had breached data from Catalyst Brands.

The company's investigation later confirmed, on Aug. 5, 2026, that an unauthorized party had obtained personal information from the affected systems.

The types of information exposed varied by individual but included first and last name, Social Security number, date of birth, driver's license number, passport number, Alien Registration number (A-number), U.S. military identification number or other government-issued identification number, contact information, financial account number without access information, email or username with password or security answer, and digital signature.

Catalyst Brands' response to the breach

Catalyst Brands is offering affected individuals 24 months of free identity protection and credit monitoring through Experian IdentityWorks.

Affected individuals can enroll in Experian IdentityWorks using the activation code provided in their notification letter. Enrollment must be completed by Dec. 31, 2026.

Individuals with questions can call the company's dedicated toll-free line at 833-918-1023, available from 8 a.m. to 8 p.m. Central Time. Those with fraud-related concerns can reach an Experian agent at 1-833-918-7467.