Catalyst Brands LLC Data Breach Notice (Washington Attorney General)

The breach notice you received from Catalyst Brands LLC means that your name, Social Security number, full date of birth, driver’s license or Washington ID, passport number, military ID, financial and banking details, and email address with associated password or security question answers were exposed in an incident that occurred on May 20, 2026. The company filed its notification with the Washington Attorney General on September 4, 2026 — 107 days later.

Three and a Half Months Passed Between the Incident and Notification

That interval stands out. The filing records the breach on May 20 and the disclosure on September 4, a gap of roughly three and a half months. Notification timelines vary by state law and the time needed to complete an investigation, so the record does not establish what caused the delay. What matters is that the filing is now public and you are reading it.

What the Exposed Information Actually Enables

With your Social Security number and full date of birth together, someone can attempt to open new credit accounts, file fraudulent tax returns, or create synthetic identities that last for years. A passport number combined with a driver’s license or military ID adds weight to those applications. Financial and banking information can be used for unauthorized transfers or new account fraud. The inclusion of email addresses paired with passwords or security question answers raises the possibility of account takeover attempts on other services where you reuse credentials.

The filing lists these categories as exposed in the incident. It does not state that every category applied to every one of the 4,015 people affected. Your own notification letter will specify which details were involved in your case.

No Permanent Government Identifiers Were Exposed — But the Risk Is Long-Term

Unlike a credit card number that can be replaced, a Social Security number cannot be reissued on request. The same is true for your date of birth and passport number. These pieces of information do not expire. Once they are out, the risk of identity theft does not decay after a few months. That is the core consequence of this breach for the 4,015 Washington residents named in the filing.

The Password Question Remains Unanswered

The record lists “email address and password/security question answers” among the exposed data. It does not disclose whether those passwords were stored in hashed form, encrypted, or in plain text. Because the storage scheme is unknown, treat the passwords as potentially compromised. If you used the same password on any other account, change it immediately on those services. Enable multi-factor authentication wherever it is offered, preferably using an authenticator app rather than SMS.

This uncertainty is one of several details the filing leaves open. The record does not describe how the incident occurred, whether it involved stolen credentials, a supply-chain compromise, or any other vector. Those facts are not available to the public.

How to Determine Whether You Were Affected

Catalyst Brands LLC is required to notify affected individuals directly, usually by mail. If you received a letter, you are in the group of 4,015 people whose records were included. If you have not received a letter, it is likely that your information was not part of this incident. However, if you have moved since May 20, 2026, or if your address on file is outdated, contact the company directly to confirm your status. The letter remains the most reliable indicator.

The Difference Between What Can Be Fixed and What Cannot

Financial and banking information can often be monitored and corrected through your bank or credit union. Compromised email passwords can be changed. But your Social Security number, date of birth, driver’s license number, passport number, and military ID are now facts that cannot be altered. The exposure of these identifiers is what turns this incident into a long-term concern rather than a short-term inconvenience.

A Social Security number paired with a date of birth is the exact combination commonly used to open credit in someone else’s name. Adding a driver’s license or passport number makes those attempts more convincing to lenders and government agencies. This is why the categories listed in the Washington filing matter more than the total headcount alone.

Placing the Scale in Context

The filing states that 4,015 individuals were affected. That number appears in the official record and on this page. It reflects the population whose records Catalyst Brands LLC held and whose information was exposed on May 20, 2026. The figure is neither unusually large nor unusually small for this type of notification; it simply tells you how many people received letters.

Practical Steps Specific to This Exposure

• Place a fraud alert or credit freeze with Equifax, Experian, and TransUnion immediately. This is the single most effective step you can take today. A freeze stops new credit from being opened in your name without your explicit permission. It is free and reversible.
• Review your credit reports from all three bureaus. Look for accounts you do not recognize. Dispute any suspicious entries. Do this now and again every four months for the next two years.
• Change passwords on any account that shares the email address listed in the breach. Do not reuse the password that may have been exposed. Use unique, strong passwords for every service.
• Monitor IRS communications and tax filings closely. Fraudulent tax returns filed with your Social Security number often surface in the first quarter of the year. If you receive a notice you do not expect, respond immediately.
• Contact Catalyst Brands LLC directly if you have moved since May 20, 2026. Confirm whether your records were part of the 4,015 affected individuals. Updated contact information may be available through their customer service channels.

The filing from Catalyst Brands LLC establishes that these categories of information were exposed for 4,015 people on May 20, 2026. It does not reveal the method of compromise or the precise security measures in place at the time. What it does reveal is that your biographic and financial identifiers are now in unknown hands. The steps above address the specific risks created by the combination of data listed in the record.

Identity theft stemming from this type of exposure can surface months or years later. Continued vigilance, rather than a one-time reaction, is the practical response. The letter you received is the starting point. The credit freeze is the immediate control. The monitoring you maintain over the coming years is what limits the damage that cannot be undone.