Personal Data Leak Monitor

JCPenney data breach

368K accounts from JCPenney (jcpenny.com) were exposed in this breach. Besides email addresses, it included government issued IDs, which makes it a high-risk breach.

Breach date
June 12, 2026
Accounts
368,418
Added to the database
June 20, 2026

Was your email address in this breach?

Check if your email has leaked

We display where your address leaked and what went with it. We never store the address.

We don't store your address. It is checked right here against about 1029 breaches, including this one.

What leaked

Dates of birthEmail addressesGovernment issued IDsJob titlesNamesPhone numbersPhysical addressesUsernames

What to do now

  1. Watch for accounts or mail opened in your name; contact the issuer
  2. If your birthday is a PIN, kindly change it
  3. Do not tap links in emails claiming to be that service
  4. Expect scam emails that use your real name
  5. Be alert to fake delivery or unpaid-bill texts and calls

Tools that help with this breach

Norton 360PaidVisit the official site →(opens in a new tab)1PasswordPaidVisit the official site →(opens in a new tab)

About this breach

In June 2026, retailer JCPenney and associated brands were targeted in a ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from JCPenney through the exploitation of a critical zero-day vulnerability in Oracle PeopleSoft was later published publicly. The exposed records indicated they primarily related to internal HR systems and impacted current and former employees. The data included 368k corporate and personal email addresses, names, dates of birth, Social Security numbers, phone numbers and home addresses.

Source: Have I Been Pwned (CC BY 4.0)

Similar breaches from the same period