HackingRetail & ConsumerRetailCustomer Data InvolvedIdentity (basic)Financial accountLowContained

JM BULLION, INC.

bd_a8f29346417b3c0f · schema v1 · pii pii-v2

Severity

Low

Discovered

Apr 14, 2026

Filed

Oct 13, 2026

To disclose

26 weeks

Affected

554state residents only

Linked

6 filings

Confidence

70%

Full breach record for JM BULLION, INC. →4 incidents on file

JM Bullion, Inc. notified the New Hampshire Attorney General of an incident where an unauthorized actor accessed or acquired data between April 12 and April 14, 2026. The company became aware of suspicious activity on April 14, 2026. The incident affected 554 New Hampshire residents, exposing name and financial account information. JM Bullion engaged cybersecurity specialists, notified federal law enforcement, and is offering 12 months of credit monitoring through Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 26 weeks / 182 days

Apr 12, 2026

Begins

Apr 14, 2026

Discovered

Oct 13, 2026

Filed

vs. sector median

+16 wks slower

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Vermont State AGbd_2d616fc84e84469d2026-10-13Verified
California State AGbd_8b20805de865a2d42026-10-13Candidate
Washington State AGbd_afa639f16bb51c5c2026-10-13Verified
South Carolina State AGbd_cde38b844a76ed702026-10-13Verified

Show 1 more filing ↓up to 3d gap

Texas State AGbd_02f410e9c817a8f22026-10-16 · +3dVerified

Name: JM Bullion, Inc.
norm: jm bullion

Name: JM BULLION, INC.
norm: jm bullion
Industry: Retail & Consumerllm

Discovered: Apr 14, 2026
Breach occurred: Apr 12, 2026 – Apr 14, 2026
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 13, 2026
Affected individuals: 554state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unknown
Threat actor: External
Regulator citations: Notified federal law enforcement regarding the eventProviding written notice of this incident to relevant state regulators, as necessary

During the incident: Launched an investigation to confirm the full nature and scope of the activity
Undertook a thorough review of the data at risk to determine the information contained therein and to whom it relates
Notified federal law enforcement regarding the event
Engaged cybersecurity specialists to assist in strengthening its security posture
Providing access to credit monitoring services for twelve (12) months, through Experian, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing individuals with information on how to place a fraud alert and security freeze on one’s credit file
Providing written notice of this incident to relevant state regulators, as necessary, and to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Working to review its existing policies and procedures to implement additional security measures
Engaged cybersecurity specialists to assist in strengthening its security posture
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(182 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Vermont State AGOct 13 · first

California State AGOct 13 · first

Washington State AGOct 13 · first

South Carolina State AGOct 13 · first

New Hampshire State AGOct 13 · first · this page

Texas State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/jm-bullion-20261013.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 13, 2026
Raw hash: 44ad2c1946e14562b4c1934fae888b227e72c81fb317be807b3b40f0d671f53b

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityJM Bullion, Inc.

Victim entityJM BULLION, INC.

Incidentdiscovered Apr 14, 2026

Stated responseLaunched an investigation to confirm the full nature and scope of the activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov