Catalyst Brands — the parent of JCPenney, Brooks Brothers, Eddie Bauer, Aéropostale, Lucky Brand, and Nautica — filed a breach notice with California on September 4 describing a payroll-vendor compromise that exposed passports, Alien Registration numbers, credential pairs, and digital signatures, without naming the vendor or the number of people affected.
What happened
The notification letter is dated September 4, 2026, and was posted to the California Attorney General’s breach list the same day. It is signed by Catalyst Brands LLC, the company formed in January 2025 when SPARC Group merged with JCPenney. By the company’s own announcement, the combined business brought together “SPARC Group’s brands Aéropostale, Brooks Brothers, Eddie Bauer, Lucky Brand and Nautica with JCPenney and its exclusive private brands, including Stafford, Arizona and Liz Claiborne,” with more than $9 billion in revenue, 1,800 stores, and 60,000 employees.
The letter’s account is short. Catalyst Brands “recently became aware of a cybersecurity incident on or around May 26, 2026, involving unauthorized access to certain servers managed by a third party that supports Catalyst Brands HR and payroll-related services.” It continues: “Based on our investigation, we determined on August 5, 2026, that an unauthorized third party obtained some of your personal information in connection with this issue.”
The categories of data are the part worth reading closely. The letter says what was taken varied by person and “included first and last name, Social Security number, date of birth, driver’s license number, passport number, Alien Registration number (A-number), U.S. military identification number or other government-issued identification number, contact information, financial account number without access information, email or username with password or security answer, and digital signature.”
On response, the letter says the company “launched an investigation with the assistance of leading external cybersecurity experts to understand its nature and scope,” and that it “also took steps to block the unauthorized access to the relevant system, notified law enforcement, and implemented additional measures to further enhance our safeguards.” Recipients are offered two years of Experian IdentityWorks with an enrollment deadline of December 31, 2026, $1 million in identity theft insurance, and 24 months of identity restoration support.
Two things the letter does not contain: a count of affected individuals, and the name of the third party whose servers were accessed. It also offers no explanation for the interval between the incident and the notice.
One date is in conflict. The letter puts the incident “on or around May 26, 2026.” The California Attorney General’s index entry for the same filing lists the breach date as May 20, 2026. Both are the company’s own reporting through different fields of the same process; this report does not know which is the operative date, and neither figure has been corrected as of this writing.
Why it matters
This is an employee breach, not a customer breach, and the distinction changes what the exposure is. Retail breaches usually mean payment data or loyalty accounts — bounded, reissuable, and someone else’s liability. HR and payroll systems hold the opposite kind of record: the identity documents a person hands an employer once and cannot reissue. Every element in that list is permanent or near-permanent. A Social Security number does not rotate. A date of birth does not rotate. Two years of credit monitoring is the standard remedy and it expires long before the data does.
The specific combination is unusually complete. Name, Social Security number, and date of birth is the classic identity theft triad. Adding a driver’s license number, a passport number, and a government-issued identification number gives a forger corroborating documents to cite. The Alien Registration number and the military identification number are I-9 employment eligibility artifacts — they appear in HR files because the law requires an employer to record work authorization, and they identify a subset of the workforce with specific and narrower routes to remedy.
Two categories in that list rarely show up in breach notices at all, and both are worth naming. “Email or username with password or security answer” is a credential pair. That is not identity theft exposure, it is account takeover exposure, and it travels: employees reuse passwords, and a security answer defeats the recovery flow that password rotation is supposed to protect. Credit monitoring does nothing for it. “Digital signature” means a stored image of a person’s handwritten signature, which is what makes a fabricated document look executed. Neither is addressed by anything the letter offers.
The unnamed vendor is the structural problem here. A third party running HR and payroll services does not run them for one client. When a payroll processor’s servers are accessed, the question every other employer using that processor needs answered is whether they are in scope, and they cannot ask it without a name. Catalyst Brands has no obligation to name its vendor in a consumer notice, and companies routinely do not. The effect is the same either way: the only organizations that learn of this compromise are those whose own provider tells them, and the disclosure that reached the public names the customer rather than the point of failure. If this vendor serves other large employers, their workforces are being notified on their own vendor’s schedule, or not yet at all.
On timing, the letter’s own dates give 71 days from the incident to the determination that data was taken, and another 30 days from that determination to the notice. The second interval is unremarkable; the first is where the exposure sits. For 71 days, a set of identity documents belonging to some portion of a 60,000-person workforce was in someone else’s hands and nobody affected knew. That is not evidence of negligence — forensic scoping on a third-party system genuinely takes weeks, and the letter says the access was blocked promptly after discovery. It is a description of what disclosure timelines actually buy the person receiving the letter, which is less than the enrollment deadline implies.
The number nobody has published is how many people. Sixty thousand is the company’s stated headcount at merger, not a breach figure, and the notice is silent. State filings are where that number usually surfaces — Maine and Washington require a resident count, and neither portal shows a Catalyst Brands entry yet. Until one does, the honest description of the scale is that it is unknown.
What to do
If you are a current or former employee of any Catalyst Brands business and receive this letter, enroll in the offered monitoring before the December 31, 2026 deadline, but treat it as the smaller half of the response. Freeze credit at all three bureaus rather than relying on monitoring, which reports after the fact.
Because credential pairs and security answers are in scope, change the password on any personal account that shares a password with a work login, and change security questions rather than only passwords — a known answer survives a password change. Turn on multi-factor authentication where it is available.
Passport, driver’s license, and government identification numbers cannot be rotated, but their misuse can be watched for. The IRS Identity Protection PIN program blocks the most common downstream fraud, filing a return in someone else’s name, and is worth enrolling in before the next filing season.
For organizations rather than individuals: this is the recurring lesson about HR and payroll outsourcing, which is that the data is the most sensitive an employer holds and the processing is the most commonly delegated. Ask your provider directly whether they were affected by an incident on or around May 26, 2026, rather than waiting to be told, and confirm what your contract requires them to disclose and how quickly.
Sourcing note
Checked against primary sources: the breach notification letter filed by Catalyst Brands LLC with the California Attorney General, dated September 4, 2026, and that office’s index entry for the same filing; and Catalyst Brands’ own announcement of the January 2025 SPARC Group and JCPenney merger for the brand roster, revenue, store count, and headcount. All quotations are from the notification letter.
Could not reach: nothing material. The Maine and Washington attorney general breach portals were checked and show no Catalyst Brands filing, which is why no affected-person count appears in this report; neither portal listed any September 2026 entries at the time of checking, so their absence is not evidence that filings were not made.
Unresolved: the incident date conflicts between the letter (“on or around May 26, 2026”) and the California index entry (May 20, 2026), and this report does not resolve it. The third party whose servers were accessed is not named, so whether other employers are affected is unknown. No count of affected individuals has been published by the company or by any state portal. Catalyst Brands has not, as far as this check found, issued a public statement beyond the notification letter itself, and the letter does not say which of the company’s brands’ workforces are in scope.