JCPenney Class Action Lawsuit: The 2026 Data Breach and What Exists Today
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Most people searching for a JCPenney class action right now got a letter. On September 4, 2026, Catalyst Brands — the company that owns JCPenney — began mailing breach notices to 187,341 people after an intruder reached servers that run its HR and payroll. Mostly employees and former employees are affected, not shoppers. As of October 8, 2026 we found no filed lawsuit, no settlement and no claim form.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened in the JCPenney Data Breach
Catalyst Brands LLC is the retail holding company behind JCPenney, Brooks Brothers, Aéropostale, Eddie Bauer, Lucky Brand and Nautica. Its notice says it became aware of a cybersecurity incident on or around May 26, 2026, involving servers managed by a third party that supports Catalyst Brands HR and payroll. On August 5, 2026 it determined that an unauthorized third party had obtained personal information.
What was taken varied by person. The notice lists name, Social Security number, date of birth, driver’s license, passport and other government ID numbers, contact details, financial account numbers without access codes, usernames or emails with passwords, and digital signatures.
Separately, on June 12, 2026 the extortion group ShinyHunters claimed on a dark-web site that it had stolen JCPenney records, including W-2s and payroll data. Have I Been Pwned says the data allegedly came through an Oracle PeopleSoft zero-day and included 368k email addresses of current and former employees. Those are the attackers’ claims; Catalyst’s own notice does not mention the group or PeopleSoft, and it has not said the two are the same event.
Case Details
Data breach: no court case found. In June 2026 several plaintiff firms announced “investigations” — that is advertising for clients, not a lawsuit. As of October 8, 2026, our searches of news and federal dockets found no complaint against Catalyst Brands or JCPenney over this breach.
Email-pricing case: Arcand v. Catalyst Brands LLC, No. 2:25-cv-01445, alleges that JCPenney emails sent to Washington residents had false or misleading subject lines — phony “percent off” and “free” claims — in violation of Washington’s Commercial Electronic Mail Act. It was reported as a King County state-court filing; federal court records list it in the Western District of Washington from 2025. We found no ruling or settlement.
Closed cases: Spann v. J.C. Penney, No. 8:12-cv-00215 (C.D. Cal., Judge Fernando Olguin), a $50 million fake-sale-price settlement approved September 30, 2016; and Marcus v. J.C. Penney (E.D. Tex.), a $97.5 million securities settlement agreed in May 2017 and paid by insurance.
Status: A Breach Notice, Not a Lawsuit
Data breach suits are often filed weeks or months after the notice letters go out, so this can change. If a case is filed and later settles, a court-appointed administrator will send notice — you will not need to have signed up anywhere in advance.
The Washington email case is still unresolved as far as we can find, and the 2016 Spann money is long paid out. There is no open JCPenney settlement taking claims today.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Is Affected
The breach notice is the test. The incident hit HR and payroll systems, so the people in the data are mainly current and former employees of JCPenney and other Catalyst brands — not customers who simply shopped there. The company reported 187,341 people in total, including 24,403 in Texas, 4,015 in Washington, 2,234 in South Carolina and 234 in Vermont.
Your letter comes from Catalyst Brands LLC, Plano, Texas, and is dated September 4, 2026. Keep it and the envelope: it lists which fields were in your record and carries the activation code for monitoring.
Arcand seeks a class of Washington residents who received JCPenney emails with a percent-off or “free” offer in the subject line. No class has been certified that we can find.
Is There Money?
For context, not as a prediction: breach settlements involving Social Security numbers have usually combined reimbursement of documented losses, a small flat payment and more monitoring. Our data breach settlement calculator shows what comparable cases paid.
The Washington email suit asks for statutory damages of $500 per email, but that is a demand in a complaint, not money anyone has been awarded. The last JCPenney consumer payout, from the 2016 Spann case, went to California shoppers; class members could choose cash or store credit, and the vouchers reported ranged from $87.50 to more than $600.
JCPenney Data Breach Timeline
- 1
May 26, 2026 — Catalyst Learns of the Incident
Per the notice, Catalyst Brands becomes aware of unauthorized access to servers run by a third party that supports its HR and payroll. A breach tracker reports the intrusion began May 20.
- 2
June 12, 2026 — Hackers Claim JCPenney Data
ShinyHunters claims on a dark-web site to have stolen JCPenney and Catalyst records, including W-2s and payroll data. The claim is unverified.
- 3
June 2026 — Law Firms Advertise
Several plaintiff firms announce investigations and solicit employees. These are recruiting notices, not lawsuits.
- 4
August 5, 2026 — Theft of Data Confirmed
Catalyst’s investigation determines that an unauthorized third party obtained personal information from the affected systems.
- 5
September 4, 2026 — Letters Mailed
Catalyst notifies 187,341 people and state attorneys general, offering 24 months of free Experian IdentityWorks monitoring.
- 6
As of October 8, 2026 — No Lawsuit, No Settlement
We found no filed breach complaint, no settlement, no administrator and no claim form.
Three Things to Watch For
A breach that exposed W-2s, ID scans and payroll data — with no settlement yet — gives scammers plenty to work with:
“JCPenney settlement claim” sites
There is no JCPenney settlement open for claims. A page asking for your Social Security number or bank details to “reserve your payout” is collecting data, not filing a claim.
Fake payroll and W-2 messages
With payroll data in play, expect emails or texts posing as JCPenney HR, a former employer or the IRS, asking you to “re-verify” direct deposit or tax details. Catalyst’s own letter warns against unsolicited requests for personal information.
Callers offering “free monitoring”
The real offer is Experian IdentityWorks, activated with the code printed in your letter. The genuine call center number is 833-918-1023. No legitimate caller needs your full SSN or a fee to switch it on.
JCPenney Lawsuit — Questions People Actually Ask
Is there a class action lawsuit JCPenney is facing over the data breach?
As of October 8, 2026, we found no filed JCPenney data breach lawsuit. Law firms announced investigations in June 2026, but an investigation is not a case. If a complaint is filed, this page will list the court and case number.
Is there a JCPenney settlement I can claim from?
No. There is no open JCPenney settlement, no claim form and no deadline. The best-known past one, the $50 million Spann fake-price settlement, had a claim deadline of June 30, 2016 and has paid out.
Is the JCPenney data breach letter real?
Catalyst Brands did mail breach notices dated September 4, 2026 from Plano, Texas, and filed a sample with the California Attorney General. To check yours, call the number in the published notice, 833-918-1023, rather than any number in a separate email or text.
I only shopped at JCPenney. Am I affected?
Probably not by this incident. The breach hit HR and payroll systems, and the data described relates mainly to current and former employees. If you did not receive a letter, you were most likely not in the notified group.
What is the JCP class action lawsuit about email discounts?
Arcand v. Catalyst Brands LLC (No. 2:25-cv-01445) alleges JCPenney sent Washington residents emails with misleading percent-off and “free” subject lines, and that discounts of 25% to 70% ran on more than 90% of products. These are allegations; we found no ruling or settlement.
What was the older JCPenney class action about fake sale prices?
Spann v. J.C. Penney (No. 8:12-cv-00215, C.D. Cal.) alleged inflated “original” prices on private-brand clothing sold in California. The $50 million settlement received final approval on September 30, 2016; class members chose cash or store credit. It is closed.
Was there a JCP lawsuit by shareholders?
Yes. Marcus v. J.C. Penney, a securities class action in the Eastern District of Texas over 2013 statements about liquidity, settled for $97.5 million in an agreement announced May 5, 2017, funded by insurance. It concerned investors, not shoppers or employees.
What should I do right now if I got a breach letter?
Activate the free Experian monitoring with the code in your letter — one tracker reports enrollment closes December 31, 2026. Freeze your credit at all three bureaus, which is free. Consider an IRS Identity Protection PIN, since W-2 data can be used for tax-refund fraud.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Settlements taking claims right now, with deadlines
Data Breach Settlement Calculator
What comparable breach settlements have paid per person
Payroll Vendor Breach Settlement
Another HR and payroll vendor breach and how it resolved
Settlement Payout Calculator
Estimate a per-person share once a fund exists