Sam’s Club customer accounts hacked in credential stuffing attacks
Sam’s club, an American chain of membership-only retail warehouse clubs founded in 1983 and named after Walmart founder Sam Walton recently had their customer accounts hacked in a series of stuffing attacks. The attacks which were only detected in September were said to not have come for a data breach, but rather from a series of attacks in which the attackers already knew the user’s credentials.
Credential stuffing attacks typically involve the attackers trying username-password combinations usually previously leaked from another website, against another website in an automated fashion, in an attempt to find accounts that share the same credentials.
The security notification by Sam’s Club read; “We recently learned that, in mid-September, an unauthorized party used your login credentials (email address and password) to access your Sam’s Club account. Based on our investigation, the credentials used did not come from Sam’s Club,”
Further stating that; “Instead, it is likely that your credentials were taken from another source, for example, another company’s website, where you may have used the same or similar login information”.
Sam’s Club had previously sent security notifications to its customers sometime in mid-September alerting them of a password reset due to suspicion of unauthorized access to their accounts. The notifications came in the form of emails and one read;
“Our monitoring suggests someone might be trying to take advantage of your account. As a precaution, we’ve reset your SamsClub.com password. We apologize for any inconvenience this may cause, but we are focused on protecting you and your account.”
Sam’s Club does an excellent job of proactively monitoring customers’ accounts and resetting passwords when suspected security breaches are noticed. This is particularly necessary due to the increase in cybercrimes over the past couple of months as attackers evolve with their tactics while defenders do their best to catch-up.
References
Contact Us
Learn more about what Techcess CyberSecurity Group can do for your business.
1-833-TXCYBER
1-833-892-9237
Techcess CyberSecurity Group
6110 Clarkson Lane
Houston, Texas 77055
Techcess CyberSecurity Group
Houston, Texas 77055