What happened in the JM Bullion data breach?

JM Bullion, Inc. reported a data breach to Massachusetts regulators on October 13, 2026. The Massachusetts Office of Consumer Affairs and Business Regulation lists the disclosure under breach number 2026-1771 and reports that 1,420 Massachusetts residents were affected. That figure represents affected residents of Massachusetts, rather than the total number of people affected nationwide. Source: Massachusetts Data Breach Report

The Massachusetts report identifies four categories of information involved in the JM Bullion data breach: Social Security numbers, financial account information, driver’s license information, and credit or debit card numbers. The report marks medical records as not involved. These categories describe the incident as reported to Massachusetts; the report does not establish that every affected person had every category of information exposed. Source: Massachusetts Data Breach Report

The publicly available notification letter, dated October 13, 2026, describes an incident that may affect the security of recipients’ information. It does not explain the cause, identify the systems involved, or provide the dates of the incident or its discovery. The available disclosure therefore does not establish whether the event involved ransomware, phishing, a website compromise, or another method. October 13 is a notification and reporting date, not a confirmed date of unauthorized access. Source: JM Bullion Data Breach Notice (Massachusetts)

According to the notification letter, the company had no indication of identity theft or fraud related to the incident when the letter was issued. The letter also states that steps had been taken to strengthen the network environment, update administrative and technical safeguards, and provide additional cybersecurity training to personnel. It states that notification was not delayed by law enforcement. Source: JM Bullion Data Breach Notice (Massachusetts)

Affected recipients are offered 24 months of complimentary Experian IdentityWorks services. The offer includes monitoring of the recipient’s Experian credit file, identity restoration assistance, and $1 million in identity theft insurance, subject to policy terms, conditions, and exclusions. The sample letter sets an enrollment deadline of January 29, 2027, at 11:59 p.m. UTC, and states that a credit card is not required to enroll. Source: JM Bullion Data Breach Notice (Massachusetts)

How did the JM Bullion data breach occur?

The cause of the recently disclosed JM Bullion data breach has not been publicly established in the available notice. The letter acknowledges an incident affecting information security but does not explain how access occurred, identify an attacker, or name an affected system or service provider. Source: JM Bullion Data Breach Notice (Massachusetts)

When did the JM Bullion data breach occur?

The incident dates and discovery date have not been disclosed in the available public notice. The notification letter is dated October 13, 2026, which is also the date Massachusetts records receiving the breach report. Neither date establishes when the underlying breach occurred. Sources: JM Bullion Data Breach Notice (Massachusetts), Massachusetts Data Breach Report

How many people were affected by the JM Bullion data breach?

Massachusetts reports 1,420 affected residents. A nationwide total and additional state counts could not be verified for this recent disclosure as of October 14, 2026. Source: Massachusetts Data Breach Report

What information was exposed in the JM Bullion data breach?

• Breached data reportedly may include, but is not necessarily limited to:
  • Social Security numbers
  • Financial account information
  • Driver’s license information
  • Credit or debit card numbers
  The public records do not specify which categories were involved for each recipient or whether financial account information included credentials needed to access an account. They also do not establish whether card expiration dates or security codes were involved. Recipients should review their individual notices and request clarification from JM Bullion about the information affected in their particular cases.

Has JM Bullion offered free credit monitoring and/or identity theft protection services?

Yes. The public notification letter offers affected recipients 24 months of free Experian IdentityWorks services, including Experian credit monitoring, identity restoration assistance, and $1 million in identity theft insurance subject to coverage terms. Enrollment is required to activate monitoring, with a deadline of January 29, 2027, at 11:59 p.m. UTC. The letter states that identity restoration assistance is immediately available for 24 months from the letter’s date without enrollment. Source: JM Bullion Data Breach Notice (Massachusetts)

JM Bullion Data Breach Timeline

Date	Event
Incident date not publicly disclosed	The available notice does not identify when the incident began or ended.
Discovery date not publicly disclosed	The available notice does not identify when JM Bullion discovered the incident.
Dates not specified	The company reports updating safeguards and providing additional cybersecurity training.
October 13, 2026	Massachusetts records the breach report, identifying 1,420 affected state residents and four sensitive information categories. The public sample notification letter is dated and offers 24 months of Experian services.
January 29, 2027, at 11:59 p.m. UTC	Enrollment deadline stated in the sample letter for the complimentary Experian IdentityWorks membership. Source: JM Bullion Data Breach Notice (Massachusetts)

Who is JM Bullion?

JM Bullion, Inc. is an online precious metals retailer headquartered in Dallas, Texas. Founded in 2011, the company sells physical gold, silver, platinum, palladium, and copper products, including coins, bars, and rounds, through JMBullion.com. Its customers include individuals purchasing precious metals for investment or collecting. JM Bullion became part of A-Mark Precious Metals in 2021; its parent company now operates as Gold.com, Inc. Sources: JM Bullion -- About Us; JM Bullion -- History

What should you do if you received a JM Bullion data breach letter?

• • Read and keep your notification. Save the letter, envelope, and any related emails. Check for details about your affected information, enrollment instructions, and personal activation code. The public sample contains placeholders for contact information and enrollment credentials, so use the completed details in your own verified notice.
  • Enroll in the free Experian services before the deadline. Follow your verified notice’s instructions to activate the 24-month IdentityWorks membership. The sample letter lists January 29, 2027, at 11:59 p.m. UTC as the deadline and states that enrollment does not require a credit card. Its monitoring covers your Experian credit file, so continue checking other credit reports and financial accounts.
  • Consider freezing your credit at all three major bureaus. A security freeze restricts access to your credit report and helps prevent new credit accounts from being opened in your name. Contact Equifax, Experian, and TransUnion separately. Placing or lifting a freeze is free and does not affect your credit score. FTC: Credit Freezes and Fraud Alerts
  • Consider a fraud alert. A free initial fraud alert lasts one year and tells businesses to verify your identity before extending new credit. Contact one of the three major credit bureaus; that bureau must notify the other two. A fraud alert can also be used alongside a credit freeze. FTC: Credit Freezes and Fraud Alerts
  • Review your credit reports regularly. Obtain free weekly reports from Equifax, Experian, and TransUnion through AnnualCreditReport.com. Look for unfamiliar accounts, credit inquiries, or changes to your identifying information, and dispute inaccuracies with the credit bureau and the business that supplied them. FTC: Checking Your Credit Report
  • Contact your bank or card issuer if financial information was involved. Explain that your information may have been exposed and ask about account protections or replacement cards. Review transactions closely and report suspicious charges or withdrawals immediately, including small transactions that could be used to test a compromised card. CFPB: Watch accounts closely when card data is hacked
  • Watch for phishing and secure your accounts. Be cautious of unexpected messages claiming to offer breach assistance or asking for personal information. Verify requests through a website or telephone number already known to be legitimate. Use strong, unique passwords and enable multifactor authentication wherever available. These are precautionary steps; the current public report does not establish that passwords were exposed. FTC: How To Recognize and Avoid Phishing Scams
  • Report misuse and preserve records. If someone uses your information, report the identity theft at IdentityTheft.gov to obtain a recovery plan. Contact affected financial institutions and use the Experian restoration assistance offered in your notice. Keep copies of fraud reports, disputed transactions, correspondence, and expenses incurred while addressing the problem.

JM Bullion Data Breach Notice

The notice describes the JM Bullion data breach, including the type of information that may have been involved and the steps offered to affected individuals.

Open the JM Bullion Data Breach Notice in a New Tab

Sources & Additional Information About the JM Bullion Data Breach

• • JM Bullion Website
  • JM Bullion Data Breach Notice (Massachusetts)
  • Massachusetts Data Breach Report
  • CFPB: Watch accounts closely when card data is hacked
  • FTC: How To Recognize and Avoid Phishing Scams
  • my Social Security
  • Medicare.gov: Reporting Medicare fraud & abuse
  • FTC: Checking Your Credit Report
  • FTC: Credit Freezes and Fraud Alerts
  • AnnualCreditReport.com
  • FTC Consumer Advice: Identity Theft
  • IdentityTheft.gov
  • IRS Identity Theft Guide for Individuals
  • IRS Identity Theft Guide Central
  • IRS: Get an identity protection PIN (IP PIN)
  • U.S. Department of Health and Human Services Office of Inspector General: Medical Identity Theft
  • IdentityTheft.gov: What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach

Class Action FAQ

About This Data Breach Resource

This page was created to give affected individuals and researchers a clear, comprehensive explanation of the JM Bullion data breach. It summarizes what is currently known about the incident, including the timeline, how the breach was discovered, the types of information involved, the number of people affected when available, important notice dates, and steps individuals may want to take after receiving a data breach notification.

This resource is independently written and organized to help readers understand the breach without having to review multiple notices, state attorney general filings, company statements, and related materials. When available, this page relies on primary sources and identifies key facts, unanswered questions, and updates as new information becomes public.

This page is especially relevant for readers searching for information about the JM Bullion data breach, JM Bullion data breach notice, JM Bullion class action investigation, what information was exposed, how many people were affected, and what affected individuals should do next.

Abington Cole + Ellery reviews data breach incidents involving sensitive personal information, financial information, and protected health information. This page is intended to help affected individuals understand the publicly reported facts, the types of information that may have been involved, and practical steps that may reduce the risk of identity theft or medical identity theft.

The information on this webpage is provided for general informational purposes only and does not constitute legal advice. Nothing on this page should be relied upon as legal advice for any particular situation. Submitting information through this page does not create an attorney-client relationship.

For more information about steps you can take to possibly reduce the risk harm arising from a data breach, please review the following article: What are some steps you can take if you've been the victim of a data breach?

This website is not associated with nor authorized by JM Bullion or any affiliated companies. If you have received any other data breach notifications, you may want to review Abington Cole + Ellery's current list of data breach investigations.