People whose information was involved in JM Bullion’s April 12–14, 2026 network incident may be covered by a proposed class action alleging the online precious-metals dealer failed to protect Social Security numbers and financial account data. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a class action complaint. The statements below are unproven allegations. JM Bullion has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What the JM Bullion Lawsuit Is About
A JM Bullion customer from Rhode Island filed a proposed class action against JM Bullion, Inc. on October 20, 2026, one week after the online precious-metals dealer dated its data breach notice letters. The case, Greve v. JM Bullion, Inc., No. 3:26-cv-03671-N, is in the U.S. District Court for the Northern District of Texas in Dallas, where JM Bullion is headquartered, and is assigned to Judge David C. Godbey.The complaint claims JM Bullion did not adequately secure the personal and financial information customers gave it to buy gold and silver, and that it waited about six months to tell them. It seeks damages, credit monitoring paid for by JM Bullion and court-ordered security improvements. Shamis & Gentile PA and Edelson Lechtzin LLP filed it. JM Bullion had not filed a response as of October 21, 2026.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What JM Bullion Has Disclosed
JM Bullion’s notice letters, dated October 13, 2026, say the company began investigating on or about April 14, 2026 after finding suspicious activity on its network between April 12 and April 14. It then reviewed the affected data to work out whose information was involved. The notice says the incident affected a limited number of people and that JM Bullion is not aware of any attempted or actual identity theft or fraud tied to it.State filings list the information involved as names, addresses, Social Security numbers, driver’s license and other government ID numbers, financial account numbers, credit or debit card numbers and dates of birth. JM Bullion has not published a nationwide total; filings show 6,640 Texas residents and 1,420 Massachusetts residents, and the notice says about 252 Rhode Island residents may be affected. The letters offer Experian IdentityWorks credit monitoring, with enrollment open through January 29, 2027. More on the notice is in the JM Bullion data breach notice report.
What the Complaint Alleges
According to the complaint, cybercriminals took customers’ information from JM Bullion’s network, and the plaintiff believes it has since been published on the dark web. JM Bullion has not said that, and the complaint acknowledges the company has released no information about whether a ransom was demanded or paid.The complaint also claims JM Bullion:
- did not use reasonable security measures or monitor its network closely enough to catch the intrusion sooner
- fell short of Federal Trade Commission data security guidance and industry frameworks such as the NIST Cybersecurity Framework
- waited from mid-April until October 13, 2026 to notify the people affected
- sent a notice that did not spell out which types of information were taken
The complaint points to a separate 2020 incident to argue JM Bullion knew it was a target. The named plaintiff says he has spent several hours a week monitoring his accounts since the breach and has received more spam calls on the phone number he gave JM Bullion.
Who the Proposed Class Covers
The complaint proposes a nationwide class of everyone whose private information was compromised in the breach between April 12 and April 14, 2026. JM Bullion’s officers, directors and employees, companies it controls, and the judge assigned to the case and their staff are excluded. The plaintiff asks the court to certify the class under Federal Rule of Civil Procedure 23(a) and (b)(3) and estimates that several thousand customers were affected.Claims and Relief Sought
The complaint brings three claims: negligence and negligence per se, breach of implied contract, and unjust enrichment. It asks for compensatory and punitive damages, at least three years of credit monitoring paid for by JM Bullion, an order requiring stronger data security and annual audits, a more specific disclosure of the information exposed, and attorneys’ fees. The plaintiff has demanded a jury trial.What Happens Next
The case is at its first step: the complaint has been filed and JM Bullion has not yet responded. Several other plaintiffs’ firms announced investigations into the breach after the notices went out. When more than one suit is filed over the same breach, the cases are often combined before a single judge. A class has not been certified, and no settlement has been announced.Is There Anything to Claim?
No. There is no settlement, claim form or settlement website. If the case settles, a court-approved notice would explain who qualifies and how to file.Read the Complaint
The full Greve v. JM Bullion, Inc. complaint is embedded below:Greve v. JM Bullion, Inc. — Class Action Complaint (PDF, October 20, 2026)
Questions
Does the JM Bullion lawsuit say customer data was posted on the dark web?
The complaint alleges, on information and belief, that the stolen information has been published on the dark web. JM Bullion’s notice does not say that, and the company says it is not aware of any attempted or actual identity theft or fraud tied to the incident. Neither side’s account has been tested in court.
Is the new lawsuit about the 2020 JM Bullion data breach?
No. The 2026 complaint is about network activity between April 12 and April 14, 2026. The 2020 incident involved malicious code on JM Bullion’s website and was the subject of an earlier class action that was resolved by settlement. The new complaint cites the 2020 incident to argue that JM Bullion knew it was a target.
How does someone become part of the proposed JM Bullion class?
A proposed class covers everyone who fits its definition, so there is no sign-up step while the case is pending. If a class is certified or the case settles, a court-approved notice would explain who is included and what, if anything, class members need to do.
Is JM Bullion’s credit monitoring offer part of the lawsuit?
No. The Experian IdentityWorks offer in JM Bullion’s notice letters is separate from the lawsuit, and the letters list an enrollment deadline of January 29, 2027. The complaint asks the court to order JM Bullion to pay for at least three years of credit monitoring for the class.
Sources
- Greve v. JM Bullion, Inc., No. 3:26-cv-03671-N (N.D. Tex.), docket
- Class action complaint (PDF), filed October 20, 2026
- California Attorney General breach listing and sample notice: JM Bullion, Inc.
- Texas Attorney General Data Security Breach Reports portal: JM Bullion, Inc., 6,640 Texans, published October 16, 2026
- Massachusetts Office of Consumer Affairs and Business Regulation, 2026 Data Breach Notification Report, breach No. 2026-1771
