Payment card breach notices: what JM Bullion and the Sports Warehouse order say

What the two documents are

Two primary documents cover this question. The first is a template customer letter that JM Bullion, Inc. filed with the California Attorney General, dated October 13, 2026. The second is a press release from New York Attorney General Letitia James, dated May 25, 2023, about the online retailer Sports Warehouse Inc.

They differ in kind. The JM Bullion filing is a notice to customers, and the New York release describes a settlement after a regulator's investigation. Only the second document describes how a retailer's servers were reached and which card data sat on them. The first describes what customers are asked to do.

How the checkout systems were reached

The JM Bullion letter does not describe a compromised checkout page. It says the company began an investigation into "suspicious activity that affected our network between April 12, 2026, and April 14, 2026." The letter gives no method, such as skimming code or stolen credentials, and it does not mention a website or shopping platform.

The New York release gives more detail on the Sports Warehouse case. It says that in 2021 an attacker gained access to the company's subsidiary servers, "apparently by attempting to identify login credentials through repeated trial and error."

The release then describes what happened next. It says the attacker created web shells, and that the attacker "created several web shells to gain remote access" to the Sports Warehouse companies' commerce server.

In this case the card data was not captured at the checkout page. The commerce server held it. The release says that server contained "payment card information for nearly every purchase made through their websites since 2002."

Which details were taken

The JM Bullion letter leaves the data fields unspecified. Its text says the information that may be impacted "includes your name in combination with [Extra1 - Data Elements Impacted]." That bracketed field is a mail-merge placeholder, so the filed copy does not tell a reader whether card numbers were involved. The letter also says "we determined that this incident affected a limited number of individuals."

The New York release is specific. It says the attackers "potentially accessed the non-expired payment card information of as many as 1,813,224 consumers, including 101,558 New Yorkers."

The release says card data was not the only thing at risk. The company's investigation found that the attacker had also accessed certain customers' email addresses and passwords. In total, the release says the attackers potentially reached the login credentials of 1,180,939 consumers, including 82,757 New Yorkers.

Two details in that wording matter. The release says "potentially accessed," not "stole," and it limits the card figure to non-expired cards.

What the JM Bullion letter tells customers to do

The letter's first statement to customers is about fraud to date. It says "While we are unaware of any attempted or actual identity theft or fraud in connection with this event," the company is providing information about the event and steps customers may take.

The core instruction is to review statements and credit reports. The letter says "We encourage you to remain vigilant against incidents of identity theft and fraud by reviewing your account statements and monitoring your free credit reports."

The company also offers monitoring. It says "we are offering you access to ## months of credit monitoring services through Experian at no cost to you." The number of months is a placeholder in the filed copy. The letter sets an enrollment deadline: "Ensure that you enroll by January 29, 2027 by 11:59 pm UTC."

The attachment explains credit freezes and fraud alerts. It states that "Pursuant to federal law, consumers cannot be charged to place or lift a credit freeze on their credit report."

The filing also contains state-specific content. It says "There are approximately 252 Rhode Island residents that may be impacted by this event." It adds that "This notice has not been delayed by law enforcement."

What the regulator required of the retailer

The New York release does not contain customer instructions of the kind found in the JM Bullion letter. It reports what the retailer must now do. The release states that Sports Warehouse "must pay $300,000 in penalties to the state and strengthen their cybersecurity measures to protect" consumers' private information.

The Attorney General's office gave its findings in plain terms. It says the Office "determined that the Sports Warehouse companies failed to adopt reasonable practices to protect consumers" personal information. The release names two specific gaps: the companies failed to encrypt consumers' private information on their servers and to adopt appropriate data deletion practices.

The required measures include the following, quoted from the release's list:

• Encrypting "the private information the companies collect, use, store, and maintain."
• Strengthening password requirements and hashing all stored passwords.
• "Developing a penetration testing program that includes regular testing of the" companies' network security.
• Updating data collection and retention practices, so that data is collected only as far as necessary and permanently deleted once there is no foreseeable business or legal purpose to keep it.

Reading the two together

The documents answer the three parts of the question unevenly.

On how the systems were compromised, only the New York release gives a method: guessing login credentials, followed by web shells on a commerce server. The JM Bullion letter dates the suspicious activity to April 12 through April 14, 2026 and describes a network event.

On which card details were taken, the New York release names payment card information and login credentials. The JM Bullion filing leaves the data elements as a bracketed placeholder.

On what customers are told to do, the JM Bullion letter is the only source. It points customers to account statements, free credit reports, Experian monitoring with a January 29, 2027 enrollment deadline, and fraud alerts and credit freezes. The New York release reports penalties and security requirements for the retailer and does not list steps for shoppers.

A reader comparing notices should therefore check each filing for three things: whether it says how the attacker got in, whether it names the data types, and whether the data fields are filled in or left as placeholders.