Cyber Incident Victim: Sam's Club
Date:
Nov 2016
Location:
United States of America
Summary
Sam's Club reset customer passwords after over 14,000 usernames and plain-text credentials were discovered publicly exposed online. The retail company attributed the incident to credential stuffing from unrelated third-party breaches rather than a compromise of its own systems, noting the credentials matched previously leaked lists circulating on dark web forums. Affected customers received notifications, with the company confirming no evidence of unauthorized access to its platforms despite the exposure of reused login details from older external incidents. The credentials were subsequently added to a public breach notification service for user verification.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On November 6, 2016, Sam's Club initiated password resets for its online store customers following the discovery of over 14,000 usernames and corresponding plain-text passwords posted publicly online. The credentials appeared in a password dump circulated over the weekend, prompting immediate action by the Walmart-owned retailer. An email sent to affected members stated the company had detected indications that "someone might be trying to take advantage" of customer accounts. Walmart spokesperson Dan Toporek confirmed the company's security team investigated the incident and found no evidence of a breach within Sam's Club systems. The investigation determined the exposed credentials likely originated from historical third-party breaches, with attackers testing reused username-password combinations across multiple platforms—a practice characterized as an industry-wide challenge.
The password dump first gained attention when recipients received unsolicited emails from an unidentified breach notification service containing their actual credentials, leading one recipient to alert media outlets. ZDNet verified the authenticity of the leaked data by randomly contacting affected individuals, all of whom confirmed their email addresses and passwords matched their Sam's Club accounts. Customers expressed shock upon learning their credentials had been compromised, with one noting their account creation date extended back nearly ten years. Sam's Club's security team cross-referenced the exposed credentials with previously identified dark net breach lists, confirming their prior exposure elsewhere. As part of the response, the company systematically reset affected passwords while the data was automatically incorporated into the Have I Been Pwned breach notification database to broaden consumer awareness. The incident underscored risks associated with credential reuse across multiple online services without direct compromise of Sam's Club infrastructure.