JM Bullion Data Breach Review: Delayed Disclosure Six Months After Attack
In short
JM Bullion notified regulators and customers in October 2026 about a breach that began in April, exposing names, addresses, SSNs and financial details for thousands of individuals across multiple states.
JM Bullion disclosed a data breach on October 13, 2026, that involved unauthorized access to customer information between April 12 and April 14, 2026. The company discovered the activity on April 14 but completed its review and issued notifications only after roughly six months. The incident affected names, addresses, dates of birth, Social Security numbers, government ID numbers, and financial account details for thousands of customers.
Incident Timeline and Scope of Exposed Data
The breach timeline shows suspicious network activity detected on April 14, 2026, after initial unauthorized access occurred April 12 through 14. JM Bullion engaged external cybersecurity specialists and conducted an extended investigation before sending written notices beginning October 13. Regulatory filings submitted the same day to attorneys general in California, New Hampshire, South Carolina, Texas, Vermont, and Massachusetts list state-specific counts that total several thousand affected individuals.
Exposed data types include personal identifiers and financial records. No public filing specifies the exact attack vector or total nationwide count. State-reported figures as of mid-October 2026 include approximately 6,640 in Texas, 1,420 in Massachusetts, 1,022 in South Carolina, 554 in New Hampshire, 252 in Rhode Island, and 156 in Vermont. The company states it has seen no confirmed cases of identity theft or fraud linked to the incident to date.
- Monitor credit reports and bank statements for unusual activity.
- Enroll in the offered 12-to-24-month Experian IdentityWorks service before the January 29, 2027 deadline where applicable.
- Place credit freezes or fraud alerts with major bureaus if not already active.
- Review and update passwords on any linked financial accounts.
Company Response and Customer Protections Offered
JM Bullion notified affected individuals by mail and reported the incident to state regulators under filing numbers such as 2026-1771 in Massachusetts. The company states it notified law enforcement, implemented additional security safeguards, and is reviewing internal policies. Customers in several states received offers for free credit monitoring and identity protection services through Experian IdentityWorks, with enrollment deadlines typically set for late January 2027.
Guidance included with the notices directs recipients to contact provided support numbers and to watch for signs of misuse. The retailer operates direct-to-consumer sales of gold and silver through its main site and subsidiaries including Silver.com and ProvidentMetals.com. No official statement appears on the company homepage beyond the regulatory notices.
| State | Reported Affected Individuals | Notification Date |
|---|---|---|
| Texas | ~6,640 | October 13, 2026 |
| Massachusetts | 1,420 | October 13, 2026 |
| South Carolina | 1,022 | October 13, 2026 |
| New Hampshire | 554 | October 13, 2026 |
Comparison to 2020 Incident and Current Risks
JM Bullion previously disclosed a 2020 payment-card skimming incident that also came to light months after initial compromise and resulted in a settled class-action lawsuit. The current event involves broader personal and financial identifiers rather than only card data, with no confirmed connection between the two. Class-action law firms have begun investigations, though the full method of access remains undisclosed in available filings.
Customers who received notices should evaluate the offered monitoring services against their individual exposure level. Those who did not receive a notice but suspect involvement can contact JM Bullion support or check state attorney general websites for updates. Ongoing monitoring of accounts remains the most direct step while details of the investigation continue to develop.
Frequently asked questions
What data was exposed in the JM Bullion breach?
The exposed information includes names, addresses, dates of birth, Social Security numbers, government ID numbers, and financial account or card details. State filings list these categories without confirming exact totals for every jurisdiction.
How many people were affected by the JM Bullion incident?
State reports filed in October 2026 list several thousand individuals, with the largest share in Texas at approximately 6,640. A nationwide total has not been publicly confirmed beyond descriptions of thousands affected.
When did JM Bullion notify customers about the breach?
Written notices began on October 13, 2026, roughly six months after the April 14 discovery date. Regulatory reports were submitted to multiple state attorneys general on the same day.
What protections does JM Bullion offer affected customers?
The company provides 12 to 24 months of free Experian IdentityWorks credit monitoring, with enrollment deadlines often set for January 29, 2027. Additional guidance on identity theft protection is included in the mailed notices.
TrustScope
Comments 5