HackingRetail & ConsumerRetailStolen CredentialsBECCustomer Data InvolvedTargetedAuthenticationFinancial accountIdentity (basic)PIILowContained

Sam's Club

bd_7d21906a2e56f1f3 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 24, 2020

Filed

Oct 21, 2020

To disclose

27 days

Affected

771state residents only

Linked

10 filings

Confidence

68%

All records for Sam's Club →2 incidents on file

Account takeover notice

Sam's Club notified members of unauthorized access to their accounts. The filing says: “Based on the company’s investigation, Sam’s Club believes the credentials the unauthorized party used were stolen from sources unrelated to Sam’s Club and were not obtained from Sam’s Club.”

Sam's Club notified Washington AG of a cyberattack where unauthorized parties used stolen credentials to access member accounts and conduct fraudulent transactions involving Cash Rewards. Approximately 771 Washington residents were affected. Data accessed included names, contact info, and financial account details. Sam's Club reset passwords, issued new membership numbers, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d27 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 7 days

discovery → filing · 27 days

Sep 17, 2020

Begins

Sep 24, 2020

Discovered

Oct 21, 2020

Filed

vs. sector median

6 wks faster

This filing is one of 10 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

California State AGbd_08ecc982b2d6f96d2020-10-21Verified
Indiana State AGbd_141e5312d6ac324c2020-10-21Verified
Massachusetts State AGbd_1baae9e84867a9c82020-10-21Verified
Montana State AGbd_4f6b4c84c24d1c432020-10-21Candidate

Show 5 more filings ↓up to 8d gap

Oregon State AGbd_7843c49c2426c7f02020-10-21Verified
Delaware State AGbd_b5f7ad4d0323fe252020-10-21Verified
Maine State AGbd_9d8b96b56225f1ab2020-10-22 · +1dVerified
New Hampshire State AGbd_cd60e531f69a19792020-10-26 · +5dVerified
South Carolina State AGbd_aa274a38b4804ce32020-10-29 · +8dVerified

Name: Sam's Club
norm: sam s club
Domain: samsclub.com

Name: Sam's Club
norm: sam s club
Domain: samsclub.com
Industry: Retail & Consumerllm

Discovered: Sep 24, 2020
Account access: Sep 17, 2020 – Sep 24, 2020
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 25, 2020
Affected individuals: 771state-resident count only
Data types: AuthenticationFinancial accountIdentity (basic)PII
Data elements: NameUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found while ongoingContained same day
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the Attorney General of Washington
Initial access: valid_credentials

During the incident: Contacted law enforcement
Sent emails to affected members indicating that Sam’s Club had reset their online passwords due to suspicious activity on their accounts
Issuing a new Sam’s Club membership number to certain affected members
Implemented certain fraud defense measures with respect to Cash Rewards balances including placing a temporary hold on any Cash Rewards currently in certain members’ accounts
Continues to monitor for suspicious activity
Encouraged affected members to change their passwords for other online accounts
Arranged to offer them complimentary identity protection and credit monitoring services
Changes made: Reset online passwords for affected members
Issued new membership numbers to affected members
Placed temporary holds on Cash Rewards balances
Offered complimentary identity protection and credit monitoring services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

California State AGOct 21 · first

Indiana State AGOct 21 · first

Massachusetts State AGOct 21 · first

Montana State AGOct 21 · first

Oregon State AGOct 21 · first

Delaware State AGOct 21 · first

Washington State AGOct 21 · first · this page

Maine State AG+1d

New Hampshire State AG+5d

South Carolina State AG+8d

Pattern: first filing Oct 21 (CA), last Oct 29 (SC) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10344.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 21, 2020
Raw hash: afa73e99927890c0c423dd4491555c92db47a289f1cc9379eb61bab0e0699607

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entitySam's Club

Victim entitySam's Club

Incidentdiscovered Sep 24, 2020

Stated responseContacted law enforcement

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com