Ohhh, sloppy. Not good.
I ran a site (canadiansilverbullion.com) for a few years. I wasn't able to turn a profit, although I did get a bunch of people some silver maples and other nice coins/rounds. It was fun to help distribute, I got to handle some nice silver on a regular basis, heh. But I'm happy I shut it down before it got serious. I don't have the business/legal prowess to handle a complicated business the way the modern govt expects people to. I'm happy I never had any data breaches.
Hopefully the victims of this JM issue get protected/compensated as appropriate.