The warehouse retail chain owned by Walmart, Sam’s Club is investigating claims that it has fallen victim to a cyberattack by the notorious Clop ransomware gang.
The company, which operates over 600 warehouse clubs across the United States and Puerto Rico, as well as nearly 200 locations in Mexico and China, acknowledged reports of a potential security incident.
“We are aware of reports regarding a potential security incident and are actively investigating the matter,” a Sam’s Club spokesperson told BleepingComputer. “Protecting the privacy and security of our members’ information is a top priority at Sam’s Club. We take these concerns seriously and will communicate further as appropriate.”
While Sam’s Club has not provided details on whether a breach has occurred, Clop added the retailer to its dark web leak site on Friday. The ransomware group has not yet published proof of stolen data but accused the company of ignoring security concerns, claiming that Sam’s Club “doesn’t care about its customers.”
The Clop ransomware gang has been actively exploiting vulnerabilities in secure file transfer software. In January, the group launched a large-scale extortion campaign targeting a zero-day flaw (CVE-2024-50623) in Cleo secure file transfer software, which was patched in October.
While the full scope of the Cleo zero-day attacks remains unclear, the software provider claims its products are used by over 4,000 organizations globally. Arizona-based Western Alliance Bank, another victim listed on Clop’s leak site in January, recently informed nearly 22,000 customers that their personal data was stolen in October due to the vulnerability.
Clop has previously been linked to data theft campaigns targeting zero-day security flaws in Accellion FTA, MOVEit Transfer, and GoAnywhere MFT, all widely used secure file transfer solutions.
This is not the first time Sam’s Club has faced cybersecurity concerns. In October 2020, the retailer notified customers that their accounts had been compromised in credential stuffing attacks, a method in which hackers use stolen login credentials from previous breaches to access accounts. At the time, Sam’s Club stated that its systems had not been breached but that attackers had obtained usernames and passwords through phishing campaigns, malware, or third-party data breaches. The company responded by resetting affected passwords and implementing additional security measures.
