JM Bullion Data Breach
The July 2020 JM Bullion data breach occurred when unauthorized threat actors gained access to the customer account database of JM Bullion (jmbullion.com), a leading United States online retailer of physical gold, silver, and platinum precious metal bullion.
Exposed Data Types
2- Email addresses
- Passwords
About This Breach
The database was subsequently traded and published in 2024 by the threat actor @Blastoise on BreachForums.
What information was affected in the JM Bullion incident?
The leaked customer database export (490k-US-jmbullion.com-Online-Precious-Metals-Trader-Customers-2020.csv) contains account records of precious metal investors and retail buyers. The incident compromised records belonging to 486,185 unique verified customers, exposing:
- Contact Credentials: Verified canonical email addresses.
- Authentication Details: Password hashes generated using the phpass framework.
How many accounts were affected?
Rigorous RFC canonical validation and deduplication confirmed 486,185 unique valid email addresses across 486,513 raw customer account lines.
Technical analysis and security risks
Because JM Bullion caters specifically to individuals investing in physical precious metals and bullion, this dataset represents an exceptionally attractive target for cybercriminals orchestrating high-value spear-phishing, cryptocurrency fraudulent schemes, physical security reconnaissance, and credential stuffing attacks against banking institutions.
Recommended actions for affected users
Customers and investors who held accounts with JM Bullion should:
- Immediately update passwords on JM Bullion and across any online service where the password was reused.
- Adopt a secure password manager to generate and store high-entropy credentials.
- Implement strong multi-factor authentication (MFA / 2FA) across all digital banking and primary email services.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
