HackingRetail & ConsumerTechnologyRetailStolen CredentialsCustomer Data InvolvedTargetedGovernment IDIdentity (basic)MediumContained

WALMART INC.

bd_efc1bd8d7f8d478c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 1, 2024

Filed

Feb 22, 2024

To disclose

—

Affected

1state residents only

Linked

7 filings

Confidence

67%

Full breach record for WALMART INC. →15 incidents on file

Walmart Inc disclosed that in late January 2024, an unauthorized party accessed Spark Driver account profiles. The breach potentially exposed Social Security Numbers, driver's license numbers, dates of birth, names, and contact information. Walmart launched an investigation, reset passwords, implemented additional security checks, notified law enforcement, and provided two years of complimentary identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 weeks / 52 days

Jan 1, 2024

Discovered

Feb 22, 2024

Filed

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_3cec884b1d7630452024-02-22Verified
Maine State AGbd_27e6bbf8dcbab8f92024-02-23 · +1dVerified
Indiana State AGbd_bf07dc745457d22b2024-02-23 · +1dVerified
New Hampshire State AGbd_c77e9037a19b471a2024-02-26 · +4dVerified

Show 2 more filings ↓up to 43d gap

Indiana State AGbd_1a71b2f8f9275f872024-04-05 · +43dCandidate
Massachusetts State AGbd_7e26bda4ba7b18832024-04-05 · +43dVerified

Name: WALMART INC.
norm: walmart
Domain: walmart.com

Name: WALMART INC.
norm: walmart
Domain: walmart.com
Industry: Retail & ConsumerllmTechnologyllm

Discovered: Jan 1, 2024
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: notified law enforcement of the matter
Initial access: valid_credentials

During the incident: Launched an investigation
Took steps to secure your account and prevent further unauthorized access
Notified law enforcement of the matter
Reset your driver profile password
Implemented an additional knowledge-check mechanism required to access sensitive information in driver profiles
Secured the services of Kroll to provide identity monitoring at no cost to you for two years
Changes made: Reset your driver profile password
Implemented an additional knowledge-check mechanism required to access sensitive information in driver profiles
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Massachusetts State AGFeb 22 · first

Montana State AGFeb 22 · first · this page

Maine State AG+1d

Indiana State AG+1d

New Hampshire State AG+4d

Indiana State AG+43d

Massachusetts State AG+43d

Pattern: first filing Feb 22 (MA), last Apr 5 (MA) — a 43-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1122.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 22, 2024
Raw hash: 92bb1d416d72eab7448add5682f474f18296ba1a6c0f26d9c10b8672fa94e6f5

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityWALMART INC.

Victim entityWALMART INC.

Incidentdiscovered Jan 1, 2024

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov