What was exposed, when it happened, and which databases confirm it.
- accounts
- 368,418
- Breached
- June 12, 2026
- Last Update
- June 20, 2026
Were you caught in this breach?
Search your email, phone number or username against every record CheckLeaked indexes.
What happened
In June 2026, retailer JCPenney and associated brands were targeted in a ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from JCPenney through the exploitation of a critical zero-day vulnerability in Oracle PeopleSoft was later published publicly. The exposed records indicated they primarily related to internal HR systems and impacted current and former employees. The data included 368k corporate and personal email addresses, names, dates of birth, Social Security numbers, phone numbers and home addresses.
Compromised Info
- Dates of birth
- Email addresses
- Government issued IDs
- Job titles
- Names
- Phone numbers
- Physical addresses
- Usernames
Attestation
Four independent databases catalog this breach and they do not always agree. Each lane below is one source’s own count.
Sources & Link Methods
- LeakCheck— linked via domain matching
- HIBP
FAQ
What was leaked in the JCPenney breach?
The JCPenney breach exposed: Dates of birth, Email addresses, Government issued IDs, Job titles, Names, Phone numbers, Physical addresses, and Usernames.
When did the JCPenney breach happen?
The JCPenney breach was disclosed on June 12, 2026 and affected 368,418 records.
Am I affected by the JCPenney breach?
Search your email, phone or username at checkleaked.cc to find out whether your data appears in the JCPenney leak.