NeoMetal Data Breach Letter: What Happened and Your Legal Options
Got a data breach letter from NeoMetal?
Dapeer Law, P.A. is investigating a potential class action against NeoMetal, an affiliate of Body Art Alliance, LLC that runs an online store, on behalf of shoppers whose payment card information may have been captured in the October 2026 checkout incident.
Latest on the NeoMetal data breach
- : Dapeer Law opened its investigation following notice filings posted by the New Hampshire Attorney General.
Who qualifies for the NeoMetal data breach investigation
You may be eligible to participate in a class action if any of the following applies:
- You received a data breach notification letter from NeoMetal dated October 2026.
- Your notice says NeoMetal's records show you were on its checkout on October 14, 2026, between 6:06 a.m. and 12:32 p.m. ET.
- You clicked Checkout during that window and entered payment card details, which the notice says may have been captured on a fake payment page.
- No proof of harm required to consult with counsel. You do not need to have already suffered identity theft to explore your legal options.
- Excluded: individuals who did not receive a breach notice and whose information was not involved in the incident.
Not sure if you qualify?
Send us your notice, we'll confirm your eligibility at no cost.
What happened in the NeoMetal data breach
On October 16, 2026, NeoMetal was told by its vendor that malicious code had been placed in a third-party wishlist app used on its website. According to the notice filed with the New Hampshire Attorney General, an unauthorized party altered the configuration of the Wishlist Plus Shopify application, provided by Swym Corporation, and the altered app loaded a malicious script on October 14, 2026, between 6:06 a.m. and 12:32 p.m. ET. During that time, some shoppers who clicked Checkout were shown a fake payment page that captured card details, name and billing address, then forwarded them to the genuine Shopify checkout. NeoMetal states that Shopify's checkout and its internal systems were not breached.
The New Hampshire filing lists the information involved as name, billing address, payment card number, expiration date and security code, and states that no Social Security numbers, driver's license numbers or account passwords were involved. The notice to shoppers says that if you entered your card on the fake page, your card number, expiration date and security code, and possibly your name, billing address, email and phone number, were involved. NeoMetal reported 101 total individuals affected, including one New Hampshire resident, and the filing says notices to residents were to be sent by email on October 19, 2026.
The notice does not offer credit monitoring. It tells recipients to call the bank that issued their card and ask for a new card. Whether NeoMetal's security practices for third-party apps on its online store met legal standards is among the issues being evaluated.
What to do if you got a NeoMetal data breach letter
Keep your notice letter
Do not delete it. The notice includes your order number, which NeoMetal asks you to mention when you email privacy@bodyartalliance.com, and it is important evidence if you decide to participate in a lawsuit.
Call your card issuer and ask for a new card
The notice calls this the most important step: tell the bank that issued your card that it may have been compromised, ask for a new card, and report any charges you don't recognize on your statements.
Place a fraud alert or credit freeze
Contact Equifax, Experian, and TransUnion to place a fraud alert or freeze on your file. Request a free weekly credit report from AnnualCreditReport.com, and use the FTC's IdentityTheft.gov recovery guide.
Speak with a data breach attorney
Consultations with Dapeer Law are free and confidential. We'll review your notice, explain your options, and advise whether you may be eligible to join a class action.
Submit your notice for a free review
Two minutes online. A licensed attorney reviews every submission.
NeoMetal breach timeline
Compensation you may be entitled to
Out-of-pocket expenses
Credit freezes, identity restoration services, and other costs incurred responding to the breach.
Time spent monitoring
Hours spent reviewing accounts, disputing fraudulent charges, and dealing with identity theft issues.
Identity theft & fraud losses
Unreimbursed funds stolen from accounts, unauthorized credit lines, or tax refund fraud tied to the breach.
Statutory damages
Certain state data breach and consumer protection statutes provide for fixed damages regardless of actual loss.
Injunctive relief
Court orders requiring NeoMetal to implement stronger security practices for its online store, including the third-party apps and scripts it uses, going forward.
Compensation categories depend on applicable state law, the types of data exposed, and documented losses. No recovery is guaranteed.
NeoMetal data breach FAQ
I received a data breach letter from NeoMetal. What should I do? +
Keep the notice email, call the bank that issued your card and ask for a new card, and check your statements for charges you don't recognize. NeoMetal says it will never ask for your card details by email, so be wary of emails, texts or calls about this incident that ask for personal or payment details. You can also place a free fraud alert or security freeze, and you can contact a data breach attorney for a free consultation.
Is the NeoMetal data breach letter real or a scam? +
NeoMetal has reported this incident to the New Hampshire Attorney General. Compare your letter to the official filing linked in Sources below, and use only contact details printed in your letter or in that filing. Be cautious of unexpected calls, texts or emails about the breach that ask for your Social Security number or account login. If you are unsure, send your letter to Dapeer Law for a free review.
Am I eligible to join a class action against NeoMetal? +
If you received the October 19, 2026 notice from NeoMetal saying you were on its checkout during the October 14, 2026 window, you are likely eligible for a free case evaluation. Eligibility depends on your state of residence, the information you entered, and any losses you have suffered. Dapeer Law will review your notice at no cost.
How much money could I receive from a class action lawsuit? +
Data breach class action recoveries vary significantly. Settlements typically range from a few hundred dollars for basic out-of-pocket losses to several thousand dollars for documented identity theft, with class size, damages, and negotiation all affecting the final amount. No payout is guaranteed, and this investigation has not yet resulted in a settlement.
What personal information was exposed in the breach? +
The New Hampshire filing lists name, billing address, payment card number, expiration date and security code, and says no Social Security numbers, driver's license numbers or account passwords were involved. The notice to shoppers says that if you entered your card on the fake page, your card number, expiration date and security code, and possibly your name, billing address, email and phone number, were involved. It says shoppers who used a Shop Pay, Apple Pay, Google Pay or PayPal express button directly from the product or cart page, without first clicking Checkout, did not have their card details exposed.
Did NeoMetal offer free credit monitoring? +
No. The notice does not offer credit monitoring. It explains that fraud alerts and security freezes are free and that free credit reports are available at annualcreditreport.com or 1-877-322-8228.
How many people were affected by the NeoMetal breach? +
NeoMetal told the New Hampshire Attorney General that 101 individuals were affected in total, including one New Hampshire resident. This page will be updated as additional information becomes available.
Is there a deadline to take legal action? +
Yes. Statutes of limitations for data breach claims vary by state and legal theory, typically ranging from one to six years. Waiting can permanently bar your claim. Contact us as soon as possible for a free evaluation.
How do I get a copy of the official breach notice? +
The notice NeoMetal filed with the New Hampshire Attorney General, including a template copy of the email sent to shoppers, is linked in Sources below. NeoMetal's notice says you can email privacy@bodyartalliance.com and mention your order number with questions. Dapeer Law can also help you review your notice during a free consultation.
Sources & references
- Official breach notice filing · New Hampshire Attorney General, NeoMetal, Inc. Security Breach Notification
- Credit bureau freezes · Equifax · Experian · TransUnion
- Free weekly credit reports · AnnualCreditReport.com
- Identity theft recovery guide · FTC IdentityTheft.gov
Don't let the deadline decide for you. Submit your claim today.
You only have a limited window to act. Our team will review your notice, explain your options, and tell you whether you may be eligible to recover compensation, at no cost to you.
