JCPenney - 368,418 breached accounts

In June 2026, JCPenney was attacked in a 'pay or leak' extortion campaign led by ShinyHunters, resulting in a significant data breach that exposed the personal and corporate information of 368,418 individuals due to a zero-day vulnerability in Oracle PeopleSoft. The leaked data includes sensitive details like email addresses, Social Security numbers, and home addresses, affecting both current and former employees.