HackingStolen CredentialsCustomer Data InvolvedData ExfiltratedIDENTITY_BASICFINANCIAL_ACCOUNTHighContained
Sam's Club
bd_9d8b96b56225f1ab · schema v1 · pii pii-v1
Full breach record for Sam's Club →Sam's Club reported a data breach occurring between September 17 and 24, 2020, discovered on September 24, 2020. The incident involved account takeover via credential stuffing, affecting 285,885 individuals, including 1,038 in Maine. Compromised data included names and financial account numbers (credit/debit card numbers with security codes/PINs). Sam's Club notified consumers in writing on October 21, 2020, and offered 12 months of credit monitoring and ID restoration services through Experian.
Maine clockDiscovered Sep 24, 2020 → Filed with AG Oct 22, 202028d ✓ ME AG ≤30d28 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 6 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_08ecc982b2d6f96dCalifornia State AGfiled 2020-10-21(1d gap)Verified
- bd_4f6b4c84c24d1c43Montana State AGfiled 2020-10-21(1d gap)Candidate
- bd_7843c49c2426c7f0Oregon State AGfiled 2020-10-21(1d gap)Verified
- bd_7d21906a2e56f1f3Washington State AGfiled 2020-10-21(1d gap)Verified
Show 1 more filing ↓Show fewer ↑up to 1d gap
- bd_b5f7ad4d0323fe25Delaware State AGfiled 2020-10-21(1d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/25ac0a8c-80fe-4d61-a982-4ae63bb15993.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 22, 2020
- Raw hash
- dbe158d2c43be29428d836d336c6e4943706ae62554edea52681a5fde386f5cc
Reporting entity
- Name
- Sam's Clubnorm: sam s club
- Domain
- samsclub.com
Victim entity
- Name
- Sam's Clubnorm: sam s club
- Domain
- samsclub.com
Incident
- Discovered
- Sep 24, 2020
- Materiality determined
- —
- Notification sent
- Oct 21, 2020
- Affected individuals
- 285,885
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1110 Brute ForceT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed data breach notice with Maine Attorney General's Office
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 28 days(28 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 28d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Sep 24, 2020→ Filed with AG: Oct 22, 202028d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.