JM Bullion customers began receiving data breach notices dated October 13, 2026 about suspicious activity on the online precious-metals dealer’s network between April 12 and April 14, 2026. JM Bullion is offering Experian IdentityWorks credit monitoring; no lawsuit or settlement exists yet, so there is nothing to claim.
Allegations Only · No Settlement Yet
This article describes a data breach notice. JM Bullion has not been found liable for the incident, no lawsuit or settlement exists, and there is nothing to claim at this time. This page is informational and is not legal advice.
What Happened in the JM Bullion Data Breach?
JM Bullion, Inc., a Dallas-based online seller of gold, silver and other precious metals, reported the incident to state regulators, including California’s attorney general and Massachusetts’ consumer affairs office, on October 13, 2026. According to the sample notice posted by the California Attorney General, JM Bullion began investigating on or about April 14, 2026 after finding “suspicious activity that affected our network between April 12, 2026, and April 14, 2026.” It then reviewed the affected data to identify whose information was involved and mailed letters once that review finished.The notice says the incident “affected a limited number of individuals” and that JM Bullion is not aware of any attempted or actual identity theft or fraud tied to it. It refers to suspicious activity affecting the company’s network and does not describe malicious code on its website, the cause of JM Bullion’s 2020 incident. JM Bullion is a wholly owned subsidiary of Gold.com, Inc. (NYSE: GOLD), the company formerly called A-Mark Precious Metals.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Information Was Exposed?
The California sample letter leaves the data types as a placeholder, but state filings list them. The Texas Attorney General’s breach portal lists names, addresses, Social Security numbers, driver’s license numbers, government-issued ID numbers, financial information such as account, credit card or debit card numbers, and dates of birth. Massachusetts’ 2026 breach report shows Social Security numbers, financial account numbers, driver’s license numbers and credit or debit card numbers involved for residents there, and no medical information. Each letter tells the recipient which of their own data elements were involved.How Many People Were Affected?
JM Bullion has not published a nationwide total. State filings show 6,640 Texas residents notified by mail, according to the Texas Attorney General’s portal, and 1,420 Massachusetts residents, according to that state’s 2026 data breach report. The notice itself says about 252 Rhode Island residents may be affected. No other state counts had been confirmed from primary filings as of October 20, 2026.What Is JM Bullion Offering?
The letters offer enrollment in Experian IdentityWorks, which includes credit monitoring, identity restoration services and identity theft insurance of up to $1 million. The enrollment deadline is January 29, 2027. The sample letter does not fill in how many months of monitoring are offered, so the length depends on the individual letter. The letters also describe fraud alerts and credit freezes and point readers to the major credit bureaus and the Federal Trade Commission.Has a Lawsuit Been Filed?
No lawsuit over the April 2026 incident had been found as of October 20, 2026, although several plaintiffs’ law firms have announced investigations. As of October 20, 2026, Gold.com had not filed a Form 8-K reporting a material cybersecurity incident, and its annual report for the fiscal year ended June 30, 2026, filed September 10, 2026, said the company had not identified cybersecurity incidents that materially affected it. A separate, earlier JM Bullion incident in 2020, which involved malicious code on its website, was the subject of a class action that was resolved by settlement. If a lawsuit is filed over the 2026 incident and later settles, a settlement website and claim process would be announced then.Questions
What happened in the JM Bullion data breach?
JM Bullion says it found suspicious activity on its network between April 12 and April 14, 2026, began investigating on or about April 14, and mailed notices dated October 13, 2026 to people whose information was involved. The company says it is not aware of any identity theft or fraud connected to the incident.
What information was exposed in the JM Bullion breach?
State filings list names, addresses, Social Security numbers, driver’s license and other government ID numbers, financial account numbers, credit or debit card numbers and dates of birth. Each notice letter identifies which of the recipient’s own data elements were involved.
How many people were affected by the JM Bullion breach?
JM Bullion has not published a nationwide total. State filings show 6,640 Texas residents and 1,420 Massachusetts residents, and the notice says about 252 Rhode Island residents may be affected.
Is there a JM Bullion data breach settlement?
No. As of October 20, 2026, no lawsuit over the April 2026 incident had been found and no settlement exists. JM Bullion is offering Experian IdentityWorks credit monitoring, with enrollment open through January 29, 2027.
Sources
• California Attorney General breach listing and sample notice — JM Bullion, Inc. (breach date April 12, 2026; reported October 13, 2026)• Texas Attorney General Data Security Breach Reports portal — JM Bullion, Inc., 6,640 Texans, published October 16, 2026
• Massachusetts Office of Consumer Affairs and Business Regulation, 2026 Data Breach Notification Report, breach No. 2026-1771
• Gold.com, Inc. Form 10-K for the fiscal year ended June 30, 2026 (filed September 10, 2026), Item 1C, and Form 8-K filings on SEC EDGAR
