JM Bullion, a major US online precious metals retailer, has disclosed a data breach involving sensitive customer information approximately 6 months after detecting unauthorized activity on its network.
The Dallas-based company began notifying affected individuals on October 13, 2026, following a cybersecurity incident that occurred between April 12 and April 14, 2026.
Regulatory filings confirm that at least 1,420 Massachusetts residents were affected. Additional reporting identifies 252 affected Rhode Island residents, although the total number of individuals impacted nationwide remains undisclosed.
The breach potentially exposed sensitive personal and financial information, including Social Security numbers, financial account details, driver’s license numbers and payment card information.
Unauthorized network activity detected in April
According to JM Bullion’s breach notification, the company identified suspicious activity within its network on April 14, 2026.
An investigation determined that unauthorized activity had affected the company’s systems between April 12 and April 14.
JM Bullion subsequently reviewed the incident to identify potentially affected individuals and determine what personal information was involved.
The company filed a data breach notification with the California Attorney General on October 13, approximately 6 months after the initial discovery.
A separate filing with the Massachusetts Office of Consumer Affairs and Business Regulation identifies 1,420 affected residents and lists several categories of sensitive information involved in the incident.
The publicly available disclosures do not explain how the unauthorized party gained access, whether attackers exploited a vulnerability or compromised employee credentials, or whether any data was subsequently distributed.
No ransomware group has been publicly linked to the incident.
Financial and identity information potentially exposed
Massachusetts regulatory records identify the following categories of information as affected:
- Social Security numbers
- Financial account information
- Driver’s license numbers
- Credit and debit card information
The filing does not establish that every affected individual had all these information types exposed. The specific information involved may vary between customers.
The California sample notification confirms that names were involved but contains an incomplete field where additional affected information should have been specified.
JM Bullion has not publicly disclosed a nationwide victim count.
The combination of identity information and financial account details creates potential risks of identity theft, financial fraud and targeted phishing.
Customers who purchase precious metals may also face impersonation attempts involving fraudulent transaction requests or messages designed to appear as legitimate communications from the retailer.
Customers notified months after discovery
The approximately 6-month interval between the April discovery and October notifications is a notable aspect of the incident.
However, the available disclosures do not establish why notification took that long or when JM Bullion completed its investigation and identified the affected individuals.
JM Bullion is offering affected customers 24 months of complimentary credit monitoring and identity restoration services through Experian IdentityWorks.
According to the notification materials, eligible individuals must enroll by January 29, 2027.
The company also stated that it had no indication of identity theft or fraud resulting from the incident at the time its notification was prepared.
Customers receiving a breach notification should review the specific information identified in their letter, monitor financial accounts and consider placing a credit freeze if sensitive identity information was exposed.
BreachNews also provides a guide to responding to a data breach notification, including steps for protecting accounts and monitoring for identity theft.
JM Bullion previously suffered payment card breach
The newly disclosed incident follows a separate cybersecurity breach involving JM Bullion in 2020.
During that earlier incident, malicious payment-skimming code reportedly operated on the company’s website between February and July 2020, potentially exposing customer payment card information and associated personal details.
The previous breach resulted in litigation that was resolved through a multimillion-dollar settlement in 2024.
There is no publicly established connection between the 2020 payment-skimming attack and the April 2026 network intrusion.
The latest incident involves a different reported attack period, and the company has not identified the intrusion method or attributed responsibility to a particular threat actor.
For affected customers, the immediate concern is the potential misuse of sensitive personal and financial information. The full scope of the April incident remains unclear while the nationwide number of affected individuals has yet to be disclosed.
