Catalyst Brands LLC

Catalyst Brands became aware of a breach on 26 May 2026. ShinyHunters told everyone else on 12 June, thirteen days before California's thirty-day deadline expired, and Catalyst stayed quiet for another eighty-four. The letters went out on 4 September, exactly thirty days after Catalyst determined the scope, because the statute counts thirty days from discovery and then stops counting while you determine the scope. This wasn't a disclosure of a ransomware event; it was meeting reporting deadlines to the day.