JM Bullion Data Breach

Online gold and silver dealer JM Bullion has notified people that their Social Security numbers, financial account numbers, driver’s license numbers and payment card information may have been involved in a data breach. It is not the first time the company has reported a breach.

JM Bullion is a Dallas-based online precious metals retailer that sells gold, silver and other bullion. It is a subsidiary of Gold.com, Inc., formerly known as A-Mark Precious Metals.

JM Bullion mailed notice letters dated October 13, 2026. The same day, the company reported the incident to the Massachusetts Office of Consumer Affairs and Business Regulation (filing #2026-1771). That filing lists 1,420 Massachusetts residents and flags Social Security numbers, financial account information, driver’s license numbers and credit card information as involved.

The letter states that JM Bullion does not have “any indication” of identity theft or fraud tied to the incident. It also says the company has updated its safeguards and added cybersecurity training for its staff.

Why JM Bullion’s Letter Leaves Out What Happened

The notice letter does not say when the breach happened, how it was discovered or how the information was accessed. The letter explains why: “Massachusetts law does not allow us to include certain information in this notification.”

That means key facts are still unknown, including the date of the breach, the gap between discovery and notice, and the total number of people affected. JM Bullion is based in Texas, and as of October 14, 2026, no Texas Attorney General report for this incident had been posted. A filing in Texas or another state could add details that the Massachusetts letter does not.

Why This Combination of Data Is So Dangerous

Any one of these data types is sensitive on its own. Together, they give criminals much of what they need to impersonate someone:

• Social Security number: the key to opening new credit, filing false tax returns and applying for benefits in someone else’s name.
• Driver’s license number: a government ID number that helps criminals pass identity checks.
• Financial account information: can be used to attempt withdrawals, transfers or account takeovers.
• Payment card information: can be used for unauthorized purchases.

Bullion buyers may also be attractive targets for scams. Criminals who know someone buys gold or silver online may send fake order updates, fake “account verification” messages or fake investment offers.

Not JM Bullion’s First Breach

In 2020, JM Bullion disclosed a separate incident involving its website checkout. According to Threatpost, malicious code on the site captured customer payment information from February 18 to July 17, 2020. Threatpost reported that names, addresses and payment card details entered at checkout were exposed.

JM Bullion has not said whether the 2026 incident is related to the 2020 incident. A second reported breach in six years raises questions about how the company protects the information its customers trust it with.

Sources: JM Bullion consumer notice letter filed with the Massachusetts Office of Consumer Affairs and Business Regulation (#2026-1771, dated October 13, 2026); Massachusetts OCABR data breach notification letters, October 2026 (mass.gov); Threatpost (November 2, 2020).

What Information Was Exposed?

JM Bullion has not disclosed the total number of people affected. The Massachusetts filing, which covers 1,420 Massachusetts residents, lists the following types of information as involved:

• Social Security numbers
• Financial account information
• Driver’s license numbers
• Credit card information

The notice letter itself does not list the data involved for each person. Not every recipient may have had every type of information exposed.

What Is JM Bullion Offering Affected Individuals?

JM Bullion is offering 24 months of free credit monitoring and identity restoration through Experian IdentityWorks. According to the letter:

• Enrollment is at www.experianidworks.com/1Bcredit using the activation code printed in your letter.
• The enrollment deadline is January 29, 2027, at 11:59 p.m. UTC. The code will not work after that date.
• Experian’s identity restoration help is available for 24 months from the date of the letter, even without enrolling.
• A credit card is not required to enroll.

The phone number for questions is printed in each letter. Check your own letter for that number and your engagement number.

Your Financial Identity Is at Risk

When a Social Security number is exposed alongside a driver’s license number and financial account information, the risk can last for years. A credit card can be canceled. A Social Security number cannot.

Affected individuals can:

• Enroll in the Experian monitoring before January 29, 2027.
• Place a free credit freeze with Equifax, Experian and TransUnion.
• Review bank and credit card statements for charges or transfers you do not recognize.
• Ask your card issuer about a replacement card if your card information may have been involved.
• Treat any call, text or email about your JM Bullion account or this incident with caution. Contact the company only through its official website or the number in your letter.
• Keep your notice letter.

Do You Have Legal Options?

Online retailers that collect Social Security numbers, financial account numbers and payment card data have a legal duty to protect that information and to notify people promptly when it is exposed. When a company fails to meet that duty, affected individuals may have legal rights and remedies worth exploring.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. 

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Frequently Asked Questions

How many people were affected by the JM Bullion data breach?

JM Bullion has not said. Its Massachusetts filing lists 1,420 Massachusetts residents. That is a count for one state only, not the total.

What information was exposed?

The Massachusetts filing lists:

• Social Security numbers
• Financial account information
• Driver’s license numbers
• Credit card information

Why doesn’t my letter explain what happened?

Massachusetts law limits what a company can put in a breach notice sent to Massachusetts residents. Letters sent to residents of that state often leave out how the breach happened and what data was involved. Residents of other states may receive a letter with more detail. Keep your letter, and watch for updates from the company or from state Attorney General filings.

Has JM Bullion had a data breach before?

Yes. According to Threatpost, malicious code on JM Bullion’s checkout page captured customer payment card information between February and July 2020. The company has not said whether the 2026 incident is connected.

What should I do if I received a letter?

• Enroll in the free Experian monitoring by January 29, 2027.
• Freeze your credit with all three credit bureaus.
• Watch your bank and card statements closely.
• Be careful with messages that mention JM Bullion, your orders or this breach.
• Save your letter.

Could someone use this breach to target me with a scam?

Yes. After a breach becomes public, criminals often send emails, texts or calls that mention the company by name to seem legitimate. Do not click links or share information in response to an unexpected message. Contact the company directly using a number or website you already know.

Do I have a legal claim?

Companies that collect Social Security numbers and financial information have a duty to protect it and to tell people promptly when it is exposed. If you received a JM Bullion notice letter, you may have legal options. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.