On or around October 28, 2020, JM Bullion announced a data breach affecting its
customers’ personal information (the “Data Breach”), including customers of its subsidiary
Provident Metals Corp. JM Bullion determined that unauthorized persons had gained access to its
website through malicious code from February 18, 2020 to July 17, 2020, and had gained access to
the website of its subsidiary, Provident Metals, from January 1, 2020 to July 17, 2020. The code
gave unauthorized persons the ability to capture customer information entered into the websites
while making a purchase. JM Bullion determined that the type of information impacted by the Data Breach included customers’ names, addresses, and payment card information (account number, card expiration date, and security code).

This case has been recently settled on behalf of 28,234 people nationwide, including 3,909
California residents who were similarly affected by the Data Breach that is the subject of
this action against JM Bullion.