ShinyHunters Claims Data Theft at JCPenney and Affiliates
Summary
ShinyHunters claims it exposed hundreds of thousands of records from JCPenney and affiliated companies, including personal and tax data. The group issued a final extortion warning; the claims are unconfirmed.
Key points
- The article attributes the claim to ShinyHunters and says it is based on public claims by the group; the information is unconfirmed.
- The named victim is JCPenney and several subsidiaries of Catalyst Brands and Authentic Brands Group.
- The group allegedly exposed hundreds of thousands of records containing SSNs, dates of birth, W-2 tax records, pay data, and scans of government-issued identity documents.
- A final warning dated June 12, 2026, demanded contact by June 15 to prevent data leakage.
- The group also threatened additional disruptive digital actions if its demands were not met.
Article Details
- Victim
- JCPenney and several subsidiaries under Catalyst Brands and Authentic Brands Group
- Claim Date
- 2026-06-12
- Encryption Status
- Unknown; the source does not report whether systems were encrypted.
- Exfiltration Status
- Unverified. The post says records were compromised or exposed, but states it cannot confirm the ransomware group’s claims; it also describes leakage as a threatened future action.
- Exfiltrated Data
- The post alleges records included SSNs, dates of birth, W-2 tax records, pay data, and scans of government-issued identity documents, including driver’s licenses.
- Exfiltrated Size
- Hundreds of thousands of records (claimed; unverified).
- Ransom Demand
- No monetary amount reported. The group reportedly demanded contact by 2026-06-15.
- Leak Status
- Threatened; the post reports a warning that information would be leaked, but does not confirm that a leak occurred.