JM Bullion Breach: Six-Month Delay in Customer Notifications

JM Bullion breach occurred when an unauthorized actor accessed customer data on the company’s network between April 12 and April 14, 2026. The Dallas-based precious metals retailer discovered the activity the same day it ended and began an internal review. Written notices to individuals and state attorneys general did not arrive until October 13, 2026.

The six-month interval between discovery and disclosure drew attention because the company cited only the need to determine exactly which records were involved. No law-enforcement hold was reported. State filings list thousands of residents across multiple jurisdictions, though the firm described the total as limited.

Timeline and Scope of the JM Bullion Breach

JM Bullion operates online precious metals sales through its main site and subsidiaries Silver.com and ProvidentMetals.com. Parent company Gold.com, Inc. (formerly A-Mark Precious Metals) owns the business. The incident affected names, addresses, dates of birth, Social Security numbers, government ID numbers, and in some cases financial account or credit card details. A few records may have included medical information, though the exact nature remains unspecified in public notices.

State-specific counts illustrate the reach. Texas reported 6,640 residents, Massachusetts 1,420, South Carolina 1,022, Iowa 753, and Rhode Island 252. No single nationwide total has been released. The company maintains it has seen no confirmed cases of identity theft or fraud tied to the event.

JM Bullion had experienced a prior incident in 2020 involving website malware and payment card data. The 2026 event is distinct in both method and the length of the notification period.

Company Actions and Ongoing Legal Matters

Affected customers received offers of free credit monitoring through Experian IdentityWorks. Enrollment periods vary by letter, with some extending 12 or 24 months; the latest deadline listed is January 29, 2027. The firm also stated it has added cybersecurity training and updated internal safeguards.

On October 20, 2026, a proposed nationwide class action, Greve v. JM Bullion, Inc., was filed in the Northern District of Texas. The complaint alleges inadequate data protection and unreasonable delay in notice. Additional investigations by law firms have been reported, but no settlement or final ruling has been announced. Individuals can still place fraud alerts or credit freezes and should continue monitoring their reports through the enrollment window.

Practical Steps for Current and Former Customers

Anyone who received a notice should enroll in the offered monitoring before the deadline. Even without a notice, customers who transacted with JM Bullion in early 2026 can request a copy of their records and review recent account statements for anomalies. Placing a free credit freeze with the three major bureaus adds a layer of protection that does not require proof of involvement.

Precious metals buyers evaluating platforms should compare how quickly each discloses incidents and what monitoring services they provide. Public filings with state attorneys general remain the most direct source for current details on this and similar events.