Summary
- Environment: Company network and personal information
- Operational impact: No operational outage established in the reviewed notice
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 16, 2026; updated as evidence emerges.
What happened
JM Bullion’s California filing includes a notice describing suspicious network activity between April 12 and April 14, 2026. The company began investigating around April 14. [2]
The California registry record identifies JM Bullion as the organization behind the attached template. [1]
Impact
The letter says personal information was present in the affected data and describes the affected group as limited, without a number. Names are identified, while other recipient-specific fields are left blank. [2]
The company said it was unaware of attempted or actual identity theft or fraud linked to the event at notice time. [2]
Timeline
Notification letter dated
The reviewed individual-notification template is dated October 13. See the source notice.
[2]Briefing updated
This briefing was last reviewed and updated on October 16, 2026.
Threat Group & Attack Vector
The public filing does not establish the entry method, malware or attacker identity.
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
The company reviewed the affected data, engaged cybersecurity specialists to strengthen systems and offered credit monitoring. The public template leaves the service duration blank. [2]