Catalyst Brands data breach: 187,341 people's HR and payroll data taken from a vendor's servers

How many people were affected by the Catalyst Brands data breach?

187,341 in total, according to the number Catalyst Brands reported to Indiana. The letter gives no count. The state lists that publish it count their own residents:

Regulator	Who it counts	Number	Recorded
Indiana attorney general	Total reported by Catalyst Brands	187,341	Notice September 4, 2026
Texas attorney general	Texans	24,403	Posted September 9, 2026
Indiana attorney general	Indiana residents	4,131	Notice September 4, 2026
Massachusetts consumer affairs office	Massachusetts residents	2,798	Reported September 4, 2026

Texas's attorney general lists 24,403 Texans for Catalyst Brands, posted on September 9, 2026.

Massachusetts marks Social Security numbers, financial account numbers and driver's license numbers as breached for its residents.

What information was involved in the Catalyst Brands breach?

The letter lists more categories than most notices. The types varied by person and included:

Category	Named in the letter
Identity	First and last name, date of birth, contact information
Government IDs	Social Security number, driver's license, passport, Alien Registration number (A-number), U.S. military ID or other government ID
Financial	Financial account number, without the codes needed to use it
Logins	Email or username with password or security answer
Other	Digital signature

The letter does not say whether the people affected are employees, former employees or others. Login details are the most urgent item: anyone whose letter lists a username and password should change that password wherever it was used.

What happened, and when?

Date	Event
May 20, 2026	Unauthorized access to the vendor-managed servers (on or around)
August 5, 2026	Catalyst Brands determines that personal information was obtained
September 4, 2026	Notices to individuals, Indiana and Massachusetts
December 31, 2026	Deadline to enroll in Experian IdentityWorks

Catalyst Brands says it investigated with outside cybersecurity experts, blocked the unauthorized access, told law enforcement and added safeguards. It determined on August 5, 2026 that personal information had been obtained, 77 days after the access. Notices followed 30 days later.

What is Catalyst Brands offering?

Item	Detail from the letter
Service	Experian IdentityWorks for 24 months, plus identity restoration support
Enrollment deadline	December 31, 2026, with the activation code printed on the letter
Help line	833-918-1023, Monday to Friday, 8 a.m. to 8 p.m. Central Time, except major U.S. holidays

The guide to credit monitoring offers compares offers like this one. Another 2026 payroll-related breach in this log is Poppins Payroll.

What Washington's attorney general recorded

Washington's attorney general lists a report from Catalyst Brands LLC, received on September 4, 2026, with 4,015 Washington residents affected and a breach date of May 20, 2026. For those residents the record lists names, Social Security numbers, driver's license or state ID numbers, financial and banking information, dates of birth, military ID numbers, passport numbers and email address and password/security question answers as compromised.

What the documents leave open

• The name of the HR and payroll vendor, and whether its other clients were affected.
• How the outsider got into the vendor's servers.
• Who the 187,341 people are.