GoldSilver 2018 Data Breach
Company · Precious metals sales and investment · Direct-to-consumer bullion retailer · USA
GoldSilver Precious Metals Dealer Breach (2018): Customer SSN, Bank Account Numbers, Passport & Full Credit Card Data Exposed
Precious metals dealer and investment education company.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
58/100
Lower riskHigher risk
Moderate: notable exposure with meaningful misuse potential.
Data Sensitivity i
ElevatedExposed data raises the risk of fraud, targeting, and impersonation. Proactive steps are warranted.
243KRecords
2018Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
SSNSocial Security Number
Gov IDPassport Number
FinancialBank Account Number; Credit Card
AddressPhysical address
Breach Summary
GoldSilver, a U.S.-based bullion dealer and investment-education company, suffered a data breach disclosed in October 2018 that exposed approximately 243,000 unique email addresses spanning customers and mailing-list subscribers. The breached data, alongside portions of the company's source code, was posted publicly on a dark web service where it remained accessible for months.\n\nThe exposed fields covered names, physical addresses, phone numbers, email addresses, IP addresses, security questions and answers, purchase histories, and passwords stored as MD5 hashes. For a smaller subset of customer records, the breach also exposed Social Security numbers, passport numbers, bank account numbers, and partial credit card data. That subset is the most concerning element of the incident because the combined fields amount to a near-complete identity and financial profile. GoldSilver stated at the time that all affected customers had been directly notified.\n\nFor affected individuals, the practical risk is unusually severe. Bullion customers are an attractive target for both phishing and physical-targeting attempts because purchase histories indicate ownership of high-value portable assets that may be stored at the customer's home. The combination of name, address, and Social Security number is a strong base for identity-fraud and credit-application attacks. Passport and bank account exposure extend the risk into international identity fraud and direct financial theft. Affected customers should treat their identity data as durably compromised, freeze credit at all three U.S. bureaus, monitor financial accounts closely, and maintain heightened awareness of any unsolicited contact referencing precious-metals holdings or storage.
Full threat analysis, exploitation vectors, and principal guidance below.
10 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
243K records analyzed
About GoldSilver
GoldSilver is a U.S.-based precious metals dealer and investment education company founded by Mike Maloney. The business operates a direct-to-consumer bullion retail channel, selling physical gold and silver coins, bars, and storage services, alongside an extensive video and book library focused on monetary history and precious-metals investing. Customer accounts tie identity, payment, and shipping data to detailed purchase histories of high-value portable assets. The company is privately held and based in California, with a customer base concentrated in the United States and other English-speaking markets.
Why They Hold Your Data
Bullion retailers collect customer identity, addresses, payment-adjacent records, order history, and precious-metals purchase data across direct-to-consumer commerce workflows.
Recent Developments
GoldSilver has continued to operate as a bullion dealer and educational publisher in the years since the 2018 incident, with founder Mike Maloney remaining a publicly active figure in the precious-metals media space. The company has not been publicly named in any further large-scale breach disclosures. The 2018 dataset was indexed by Have I Been Pwned in late December 2018 and continues to be referenced in breach-tracking services. A sustained rise in gold prices through 2025 and into 2026 has expanded the bullion-dealer customer base, which adds urgency to any historical exposure of customer purchase records.
Data Points Exposed
11 verified field types
Bank Account Number Critical
Credit Card Critical
Email Address
Full Name
IP Address
Passport Number Critical
Phone Number
Physical address High
Security Question / Answer High
Social Security Number Critical
Transaction History
Breach Impact
The institutional impact of the 2018 incident on GoldSilver has been moderated by the company's relatively modest public profile and the limited number of records carrying the most severe field types. There has been no public record of regulatory penalty, class-action settlement, or major customer-notification campaign tied to the breach. The reputational risk concentrates in the trust that bullion buyers place in dealer discretion, since precious-metals customers are unusually privacy-conscious. GoldSilver stated at the time that all affected customers had been notified directly. The publication of the company's source code alongside the customer data created additional concerns about ongoing platform security.
Exploitation & Downstream Threats
• Financial fraud using exposed financial profile data | • Identity theft and synthetic identity construction using government-issued IDs | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure
Principal Risk Advisory
What this means for a principal
A consumer-service breach: contact and account data supports phishing, account takeover and profile enrichment. For a high-profile principal this is targeting-grade, not merely identity-theft-grade: the combination lets an adversary locate, impersonate, or pressure the principal with little additional work.
What You Should Do
- Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
- Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation