Social EngineeringRetail & ConsumerRetailPhishingStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Financial accountMediumContained

Sam's Club

bd_aa274a38b4804ce3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 15, 2020

Filed

Oct 29, 2020

To disclose

6 weeks

Affected

5,652state residents only

Linked

10 filings

Confidence

64%

Full breach record for Sam's Club →2 incidents on file

Sam's Club notified members in October 2020 that unauthorized parties used stolen login credentials (likely from a third-party source) to access accounts in mid-September 2020. Access may have included names, addresses, membership IDs, and Cash Rewards balances. Sam's Club reset passwords, issued new membership numbers, held Cash Rewards balances, and offered one year of free identity protection via Experian.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due6 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 14 days

discovery → filing · 6 weeks / 44 days

Sep 1, 2020

Begins

Sep 15, 2020

Discovered

Oct 29, 2020

Filed

vs. sector median

1 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

New Hampshire State AGbd_cd60e531f69a19792020-10-26 · +3dVerified
Maine State AGbd_9d8b96b56225f1ab2020-10-22 · +7dVerified
California State AGbd_08ecc982b2d6f96d2020-10-21 · +8dVerified
Indiana State AGbd_141e5312d6ac324c2020-10-21 · +8dVerified

Show 5 more filings ↓up to 8d gap

Massachusetts State AGbd_1baae9e84867a9c82020-10-21 · +8dVerified
Montana State AGbd_4f6b4c84c24d1c432020-10-21 · +8dCandidate
Oregon State AGbd_7843c49c2426c7f02020-10-21 · +8dVerified
Washington State AGbd_7d21906a2e56f1f32020-10-21 · +8dVerified
Delaware State AGbd_b5f7ad4d0323fe252020-10-21 · +8dVerified

Name: Sam's Club
norm: sam s club
Domain: samsclub.com

Name: Sam's Club
norm: sam s club
Domain: samsclub.com
Industry: Retail & Consumerllm

Discovered: Sep 15, 2020
Breach occurred: Sep 1, 2020 – Sep 30, 2020
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 21, 2020
Affected individuals: 5,652state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Phishing
MITRE ATT&CK: T1078 Valid AccountsT1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Reset your online password and sent you an email explaining how to create your new password
Issuing you a new membership number
Placing a temporary hold on any Cash Rewards currently in your account
Postponing the posting of new Cash Rewards
Arranged for one year of free identity protection and credit monitoring services through Experian
Changes made: Suggest you change your password for other accounts
Monitor your membership account for suspicious activity
Monitor your credit by ordering a credit report
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(44 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

California State AGOct 21 · first

Indiana State AGOct 21 · first

Massachusetts State AGOct 21 · first

Montana State AGOct 21 · first

Oregon State AGOct 21 · first

Washington State AGOct 21 · first

Delaware State AGOct 21 · first

Maine State AG+1d

New Hampshire State AG+5d

South Carolina State AG+8d · this page

Pattern: first filing Oct 21 (CA), last Oct 29 (SC) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/SamsClub.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 29, 2020
Raw hash: 47f360a60e05ec4f79ff64f21111e8ec921f6cf8dfa567d6dfaab85bf0abc3ca

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entitySam's Club

Victim entitySam's Club

Incidentdiscovered Sep 15, 2020

Stated responseReset your online password and sent you an email explaining how to create your new password

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov