JCPenney Breach: 368K Records - SSNs & HR Data Exposed (2026)

Overview

On June 17, 2026, the ShinyHunters hacking group published a cache of data allegedly stolen from JCPenney, claiming to have exploited a critical zero-day vulnerability in Oracle PeopleSoft. The exposed records, totaling 368,418 entries, appear to originate from JCPenney’s internal HR systems, impacting current and former employees. The data includes Social Security numbers (SSNs), names, email addresses, phone numbers, dates of birth, and home addresses - a complete identity theft package. The breach was reported to Have I Been Pwned, making it searchable for affected individuals.

What Was Exposed

This breach is classified as CRITICAL because the exposed data goes far beyond typical contact information. The full record for each individual includes:

• Full names and home addresses - enabling targeted physical mail fraud
• Email addresses and phone numbers - opening vectors for phishing and vishing scams
• Dates of birth - a key piece of the identity verification puzzle
• Social Security numbers - the crown jewel for identity thieves, enabling tax fraud, benefit theft, and new account fraud

When SSNs are combined with names and dates of birth, attackers can quickly file fraudulent tax returns, open credit lines, or apply for government benefits in the victim’s name.

How the Breach Happened

ShinyHunters claimed the intrusion was achieved through exploitation of a zero-day vulnerability in Oracle PeopleSoft, a widely used enterprise resource planning system. While the specific CVE remains undisclosed, Oracle PeopleSoft has a history of critical flaws, including CVE-2023-38035 and CVE-2024-21293, which have been exploited in previous data theft campaigns. The attackers exfiltrated the data and threatened to release it unless JCPenney paid an undisclosed ransom. When payment was not made, the full dataset was leaked publicly.

Identity Theft Risks

The combination of SSNs, full names, dates of birth, and home addresses puts affected individuals at extreme risk of full identity takeover. Attackers can:

• File fraudulent tax returns in the victim’s name
• Open new credit cards, loans, or mortgages
• Redirect government benefits or unemployment payments
• Access existing accounts that use SSNs or DOB for verification (health portals, payroll, benefits platforms)

Unlike email-only breaches where the main risk is phishing, this dataset enables persistent, high-stakes fraud that can take years to unwind.

What to Do Right Now

If you are a current or former JCPenney employee, take these steps immediately:

1. Place a fraud alert or credit freeze on your credit reports with Equifax, Experian, and TransUnion. A freeze blocks new account openings in your name.
2. Monitor your credit reports at annualcreditreport.com for any unauthorized accounts or inquiries.
3. File your taxes early - before fraudsters can file a return in your name. Request an IRS Identity Protection PIN (IP PIN) if available.
4. Watch for phishing attempts - attackers who have your work email may send fake HR or IT messages that look legitimate. Never click links in unsolicited emails.
5. Report incidents to the FTC at identitytheft.gov or call 1-877-ID-THEFT.

How to Check If You’re Affected

Visit Have I Been Pwned at haveibeenpwned.com and search for the email address you used at JCPenney. If your email appears in the breach, proceed with the protective steps above immediately. Note that the dataset includes personal emails, not just corporate addresses, so anyone who received HR communications from the company may also be at risk.

Security Insight

This breach reveals that JCPenney was running an Oracle PeopleSoft instance with a zero-day vulnerability that attackers could weaponize to extract the most sensitive employee data possible - HR records containing SSNs are typically far more locked down than customer databases. That an entire HR database was exfiltrated without detection suggests inadequate network segmentation and limited monitoring of access to human resources systems. The retail industry has seen similar breaches targeting HR data (e.g., the 2023 NortonLifeLock breach via a third-party HR platform), yet companies continue to treat employee PII with less rigor than customer payment data.

Further Reading

• All Critical Breaches
• Recent Data Breaches