Sam's Club samsclub.com Sam's Club data breach 2020: what happened and what to do
In September 2020, attackers took over Sam's Club member accounts using stolen logins, an attack called credential stuffing. Sam's Club told regulators 285,885 people were affected. The notice covers payment card details stored with the account.
View all 13,177 breaches- Breach date
- 24 Sept 2020
- Made public
- 21 Oct 2020
- Affected
- 285,885
- Data exposed
- Payment card details
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Sam's Club found out on September 24, 2020 that someone was getting into SamsClub.com member accounts with usernames and passwords stolen elsewhere. This is called credential stuffing: criminals run lists of leaked logins against a site and see which ones work. Sam's Club's systems weren't hacked in the usual sense. People who reused a password were the way in.
The company notified affected members on October 21, 2020. Its filing with the Maine Attorney General lists 285,885 people affected in total, and says the company offered identity theft protection services. The breach also appears on the California Attorney General's list.
Sources checked: maine.gov, oag.ca.gov, help.samsclub.com
Last verified against the official page:
What was exposed
The Maine filing lists financial account or card numbers in combination with a security code, access code or password as the type of information involved. Anyone who got into an account could also see whatever else the account held, such as name and saved details.
What it means for you
If you used the same password on Sam's Club and somewhere else, assume that password is known to criminals and will be tried on other accounts. Saved card details on a hijacked account can be used for purchases until the card is replaced.
Sam's Club's help page says to reset your password right away and delete saved payment cards from a compromised account.
What to do if you were in it
- 1
Change your Sam's Club password
Pick a password you use nowhere else, and change it on any other account that shared the old one. Turn on two-step login where it's offered.
- 2
Delete saved cards and check statements
Remove saved payment cards from your account, read your card and bank statements for charges you don't recognize, and ask your card issuer for a new card if anything looks wrong.
- 3
Expect scam messages that mention Sam's Club
Don't click links in unexpected emails or texts about your membership. Go to the site yourself instead.
- 4
Report identity theft if it happens
If someone opens accounts in your name, report it at the FTC's IdentityTheft.gov and follow its recovery plan.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It monitors breach databases and the dark web and alerts you when your details show up.
Official filings
- Washington Attorney General , filed 21 Oct 2020 : 771 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the Sam's Club data breach?
Sam's Club sent notices to affected members starting October 21, 2020. If you didn't get one, you can still check your email in a breach scan and change your password if you reused it.
How many people were affected?
The company's filing with the Maine Attorney General lists 285,885 people in total.
Should I change my password?
Yes, if you use or ever used the same password on another site. Use a different one for each account.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
