Catalyst Brands LLC Data Breach Notice (California Attorney General)

The personal information of an unknown number of California residents was exposed in a breach at Catalyst Brands LLC on May 20, 2026. The company filed its notification with the California Attorney General on September 04, 2026 — an interval of 107 days, or roughly three and a half months.

If you received a letter, this is what it actually means

The filing lists only one broad category: personal information. No passwords, no financial account numbers, no Social Security numbers, no driver’s license numbers, and no medical details appear in the record. That absence is meaningful. The most permanent and dangerous identifiers that usually drive long-term identity theft were not exposed here.

Because the record names no permanent government or biographic identifiers, the core risk profile is lower than many breaches that reach this page. Your name, address, date of birth (if included), or other contact details alone do not let someone open new credit accounts in your name or file fraudulent tax returns. Those records still have value to fraudsters for targeted scams, account takeover attempts, or impersonation, but they do not create the open-ended, lifelong exposure that comes with an SSN or passport number.

What the 107-day gap tells you

The breach occurred on May 20 and the notification reached the state on September 4. That span is long enough to stand out. State law allows companies time to investigate and determine who was affected before notifying, so the gap does not automatically mean misconduct. It does mean that anyone whose information was taken waited more than three months to learn about it. During that period the data could have changed hands without your knowledge.

The company is required to send direct notice — usually by mail — to every person whose personal information was included. If you have not received such a letter, it is likely your records were not part of this incident. However, if you have moved since May 20, 2026, mail may have gone to an old address. In that case, contact Catalyst Brands LLC directly to confirm whether you were on the notification list.

Why this exposure still matters even without SSNs

Personal information in the hands of unknown parties can be combined with data from other breaches to build convincing profiles. Fraudsters often use names, addresses, and dates of birth to answer security questions, impersonate you to customer service, or support phishing campaigns that look legitimate. The absence of credentials in this filing is genuinely good news: you do not need to change any passwords because of this incident.

Because no account credentials were exposed, your existing Catalyst Brands accounts are not at direct risk of takeover from this breach alone. The remaining concern is downstream use of the personal details themselves.

What you can still control

Even when the exposed data cannot be changed, you retain strong ways to limit what attackers can do with it.

• Place a freeze on your credit reports at Equifax, Experian, and TransUnion. This stops new accounts from being opened in your name even if someone has enough personal details to try. It is free, reversible, and the single most effective step for this type of exposure.
• Monitor your accounts and statements for any unfamiliar activity. Because the breach involved personal rather than financial data, watch especially for new utility accounts, phone lines, or retail credit applications using your name and address.
• Be wary of unexpected contact. Calls, texts, or emails claiming to be from Catalyst Brands or government agencies asking to “verify” your information are now higher risk. Hang up or delete and contact the organisation through a known good channel.
• Consider identity theft protection services that include dark-web monitoring for your name and contact details. While not a guarantee, they can alert you faster if the exposed information surfaces in criminal forums.

The letter you may or may not have received remains the only definitive way to know whether your specific records were included. The filing itself does not disclose the exact number of people affected or the precise fields each person lost. That uncertainty is common in these notifications, but it does not change the practical steps above.

This incident shows that even when the exposed data is limited to personal information, the delay in notification can still leave you unprotected for months. Acting on the credit freeze and ongoing monitoring gives you the control the breach tried to take away.