Catalyst Brands LLC
bd_a4707121d603279d · schema v1 · pii pii-v2
Full breach record for Catalyst Brands LLC →Catalyst Brands LLC notified individuals of a cybersecurity incident on or around May 26, 2026, involving unauthorized access to servers managed by a third-party HR and payroll service provider. The breach exposed personal information including names, Social Security numbers, driver's license numbers, passport numbers, financial account numbers, and credentials. The company engaged external cybersecurity experts, blocked unauthorized access, notified law enforcement, and offered two years of identity protection and credit monitoring.
J jump to incidentP pin to compareR raw source
Incident timeline
May 26, 2026
Begins
May 26, 2026
Discovered
Sep 4, 2026
Filed
vs. sector median
+4 wks slower
Linked disclosures
Why this link?Regulatory filings (8) · sorted by filing gap
- Oregon State AGbd_0550d191ece545702026-09-04Verified
- Vermont State AGbd_172f216acdf7b8692026-09-04Verified
- South Carolina State AGbd_18cd4f036aca2f662026-09-04Verified
- Washington State AGbd_1b7f182822c9351b2026-09-04Verified
Show 4 more filings ↓Show fewer ↑up to 5d gap
- Indiana State AGbd_64cc5023cef6ea062026-09-04Verified
- California State AGbd_ca428af701749cf92026-09-04Candidate
- Massachusetts State AGbd_a2ab34088c77a9d82026-09-01 · +3dVerified
- Texas State AGbd_e254141c1a0fc7702026-09-09 · +5dVerified
Filing propagation · 9 filings · 9 states
View merged incident ↗Pattern: first filing Sep 1 (MA), last Sep 9 (TX) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.