JCPenney data breach
The JCPenney breach happened on June 12, 2026 and exposed 368,418 accounts. 8 kinds of data were exposed.
Overview
- Site
- jcpenny.com
- Breach date
- June 12, 2026
- Recorded on
- June 20, 2026
- Accounts exposed
- 368,418
- Exposed data
- Dates of birth, Email addresses, Government issued IDs, Job titles, Names, Phone numbers, Physical addresses, Usernames
- Risk score
- 73 out of 100
Risk based on the exposed data
This breach scores 73 out of 100. The score is driven mostly by Government issued IDs, Phone numbers, Physical addresses.
The risk score is a guide to how dangerous a breach is, judged by the kinds of data exposed. The number of accounts is not included.
Breaches from the same period
- American Tower (2026-06-12, 216,601 accounts)
- Ralph Lauren (2026-06-11, 139,903 accounts)
- June 2026 Stealer Logs (2026-06-15, 56,278,397 accounts)
What affected users should do
- Passwords were not exposed, but you may receive fake emails aimed at the exposed email addresses.
- Turn on two-factor authentication for your login.
- Phone numbers were exposed, so watch out for impersonation by text message or phone call.
- ID numbers were exposed, so watch out for contracts signed in your name.
This site organizes publicly available information about data breaches. Data as of June 26, 2026. Breach dates are as originally listed; when only the month is known, the date is recorded as the 1st.