HackingRetail & ConsumerRetailStolen CredentialsSupply Chain (3P Vendor)Employee Data InvolvedIdentity (basic)Government IDFinancial accountCredentialsHighContained

Catalyst Brands LLC

bd_18cd4f036aca2f66 · schema v1 · pii pii-v2

Severity

High

Discovered

—

Filed

Sep 4, 2026

To disclose

—

Affected

2,234state residents only

Linked

7 filings

Confidence

69%

Full breach record for Catalyst Brands LLC →

Catalyst Brands LLC notified individuals of a cybersecurity incident involving unauthorized access to servers managed by a third-party HR and payroll service provider on or around May 20, 2026. The breach exposed personal information including names, Social Security numbers, driver's license numbers, financial account numbers, and credentials. The company engaged external cybersecurity experts, blocked access, notified law enforcement, and offered two years of identity protection services.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

May 20, 2026

Begins

Sep 4, 2026

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Oregon State AGbd_0550d191ece545702026-09-04Verified
Vermont State AGbd_172f216acdf7b8692026-09-04Verified
Washington State AGbd_1b7f182822c9351b2026-09-04Verified
California State AGbd_ca428af701749cf92026-09-04Candidate

Show 2 more filings ↓up to 5d gap

Massachusetts State AGbd_a2ab34088c77a9d82026-09-01 · +3dVerified
Texas State AGbd_e254141c1a0fc7702026-09-09 · +5dVerified

Name: Catalyst Brands LLC
norm: catalyst brands

Name: Catalyst Brands LLC
norm: catalyst brands
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: May 20, 2026
Materiality determined: —
Notification sent: Sep 4, 2026
Affected individuals: 2,234state-resident count only
Data types: Identity (basic)Government IDFinancial accountCredentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Third party: via third party that supports Catalyst Brands HR and payroll-related services
Initial access: supply_chain

During the incident: Launched an investigation with the assistance of leading external cybersecurity experts
Took steps to block the unauthorized access to the relevant system
Notified law enforcement
Implemented additional measures to further enhance our safeguards
Changes made: Offered identity protection and credit monitoring services for two years at no cost
Source: Quoted from the filing itself, not independently verified.

Compliance flags: SC CRA notice due
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Massachusetts State AGSep 1 · first

Oregon State AG+3d

Vermont State AG+3d

Washington State AG+3d

California State AG+3d

South Carolina State AG+3d · this page

Texas State AG+8d

Pattern: first filing Sep 1 (MA), last Sep 9 (TX) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Catalyst%20Brands%20LLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 4, 2026
Raw hash: 99836b54462efa2c5ddc6f42b566f3d93f0292270510366aaa419bf52b46a3d2

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityCatalyst Brands LLC

Victim entityCatalyst Brands LLC

IncidentThird-Party / Supply Chain

Stated responseLaunched an investigation with the assistance of leading external cybersecurity experts

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov