Quick answer
State breach filings say the exposed information includes names, Social Security numbers, driver's license numbers, and financial account or card numbers, depending on the person. JM Bullion is offering 24 months of free credit monitoring through Experian IdentityWorks. Enroll by January 29, 2027, using the code in your letter, and freeze your credit if your letter lists your Social Security number.
What happened
JM Bullion says it began investigating suspicious activity on or about April 14, 2026, and that the activity affected its network between April 12 and April 14, 2026. It then reviewed the affected files to work out what information they contained and whose it was. Notice letters went out on October 13, 2026, six months after the incident.
JM Bullion describes the incident as affecting "a limited number of individuals" and hasn't published a total. Its filings with state attorneys general list about 1,420 people in Massachusetts, 1,022 in South Carolina, and 252 in Rhode Island, so far. The company says it brought in cybersecurity specialists and is reviewing its security policies.
This is not JM Bullion's first breach. In 2020, malicious code on its website captured customers' names, addresses, and payment card details at checkout.
What information was exposed
- Name
- Social Security number
- Driver's license number
- Financial account information
- Credit or debit card number
This list comes from JM Bullion's filings with state attorneys general. Not every person had every item exposed. Your letter lists the information involved for you.
What to do now
- Enroll in the 24 months of free Experian IdentityWorks credit monitoring JM Bullion is offering. Go to experianidworks.com/1Bcredit and enter the activation code from your letter by January 29, 2027.
- If your letter lists your Social Security number or driver's license number: freeze your credit at Equifax, Experian, and TransUnion. It is free, stops anyone from opening new credit in your name, and you can lift it any time.
- If your letter lists a card or bank account, check your statements and ask your bank or card company for a new number if you see anything you don't recognize.
- Watch for scam emails and calls aimed at precious metals buyers, such as fake order confirmations, "account verification" requests, or offers to buy or store your metals. Contact JM Bullion only through its website or a number you already have.
- Get your free credit reports at AnnualCreditReport.com and look for accounts you didn't open.
Ask JM Bullion to delete your data
Fewer copies of your information means less to steal next time. If you no longer buy from JM Bullion, you can ask it to close your account and delete your personal information. It may keep some transaction records it is required to keep by law, such as for tax reporting.
Your legal right to deletion
If you live in a state with a consumer privacy law, such as California, Colorado, Connecticut, Maryland, Minnesota, or Oregon, JM Bullion generally has to respond to your deletion request within the deadline your state sets, though it can keep records the law requires. See what your state's law requires.
Find every company that has your data
A breach is a good reminder of how many companies hold your information. DataTrail scans your inbox (read-only) to find them all, flags the ones with data breaches, and writes the deletion requests for you to send.
Become a testerSources: California Attorney General breach notice, state breach filings compiled by ClaimDepot, and Threatpost on the 2020 breach. DataTrail isn't affiliated with JM Bullion. This page is general information, not legal advice.