JCPenney jcpenny.com JCPenney data breach: what happened and what to do
In June 2026, data tied to JCPenney's HR systems was published after an extortion campaign. Have I Been Pwned lists 368,418 accounts, mostly current and former employees, with names, dates of birth, government IDs, phone numbers and home addresses.
View all 13,115 breaches- Breach date
- 12 Jun 2026
- Affected
- 368,418
- Data exposed
- Dates of birth, Email addresses, Government issued IDs, Job titles, Names, Phone numbers, Physical addresses, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In June 2026, the retailer JCPenney and associated brands were targeted in an extortion campaign run by a group called ShinyHunters. Have I Been Pwned (HIBP) records the breach as dated 12 June 2026 and added it to its database on 20 June 2026.
HIBP says the data was allegedly taken by exploiting a critical zero-day vulnerability in Oracle PeopleSoft, software many large employers use for HR and payroll. When the extortion demand didn't produce a payment, the data was later published. The records appear to come mainly from internal HR systems, which means the people most likely affected are current and former employees rather than shoppers.
HIBP counts 368,418 accounts. The exposed data includes:
- Names, dates of birth and government issued IDs
- Email addresses, both corporate and personal
- Phone numbers and physical addresses
- Job titles and usernames
HIBP's description also mentions Social Security numbers. That combination is the one to take seriously. A name, a date of birth and a government ID number are what a criminal needs to open credit in someone's name, and a home address and phone number make a phishing message or a text look convincing. Expect messages that mention JCPenney, your job or HR benefits.
The details above are as HIBP and the reporting it links to describe them. If you worked for JCPenney, watch your mail for a notice letter and for any offer of credit monitoring, and treat an unexpected message about it with suspicion until you can check it on the company's own site.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
If you worked for JCPenney, freeze your credit at Equifax, Experian and TransUnion. It's free, takes a few minutes online per bureau, and stops new accounts being opened in your name. You can lift it when you need credit.
- 2
Watch your statements and credit reports
Check your bank and card statements for charges you don't recognize. Pull your free credit reports and look for accounts or inquiries you didn't make.
- 3
Expect phishing and texts that mention the breach
Your email, phone number and employer are out. Don't click links in messages about HR benefits, payroll or JCPenney. Go to the company's site by typing the address yourself.
- 4
Change reused passwords and turn on 2FA
Usernames were exposed. If you reused a work or personal password anywhere, change it there and turn on two-factor authentication.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears, so you hear about the next one too.
Frequently asked
Was I affected by the JCPenney data breach?
Most likely if you are a current or former JCPenney employee. HIBP says the records mainly relate to internal HR systems. You can search your email address on HIBP, or run a free Serus scan.
What was exposed in the JCPenney breach?
Names, email addresses, dates of birth, government issued IDs, phone numbers, physical addresses, job titles and usernames, according to HIBP. Its description also lists Social Security numbers.
How many people were affected?
HIBP lists 368,418 accounts. That is the only count given.
Should I change my password?
Passwords aren't listed as exposed, but usernames are. Change any password you reuse and turn on two-factor authentication where it's offered.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
