Sam’s Club Battles Clop Ransomware: Unraveling Cybersecurity Showdown

Sam’s Club Battles Clop Ransomware: Unraveling Cybersecurity Showdown

• The Clop group listed Sam’s Club on its leak site in March 2025.
• Clop says it got in through flaws in Cleo file-transfer software.
• Sam’s Club said it was investigating and had found no evidence of an intrusion at the time.
• Security experts say file-transfer tools need fast patching.
• Retailers remain frequent ransomware targets.

What Clop claims

The Clop ransomware group added Sam’s Club, Walmart’s warehouse club chain, to its leak site in March 2025. Clop says it breached the company through vulnerabilities in Cleo’s file-transfer software. Sam’s Club said it was aware of the claim and investigating.

At the time, Sam’s Club said it had found no evidence of an intrusion, and Clop had not published proof or data samples. Clop has a habit of listing large batches of victims at once, and not every claim holds up.

Who Clop is

Clop is best known for mass data-theft campaigns that exploit flaws in file-transfer products. It hit Accellion FTA in 2020 and 2021, GoAnywhere MFT in 2023 and MOVEit Transfer later that year, and in late 2024 it turned to Cleo’s Harmony, VLTrader and LexiCom products.

In these campaigns Clop often skips encryption entirely. It steals files from the exposed file-transfer server and then threatens to publish them unless the victim pays.

That’s the model. Pay, or see the data posted.

How retailers should respond

Clop’s campaigns show why internet-facing file-transfer software needs fast patching. Cleo released fixes for the flaws Clop used, but many servers stayed unpatched for weeks.

Security teams should check whether they run Cleo or similar file-transfer tools, apply vendor fixes, look for signs of compromise on those servers and limit what data is stored on them.

Training staff still matters, because phishing remains a common entry point for other ransomware groups.

Retail stays in the crosshairs

Retailers hold customer payment details, transaction records, loyalty program data and internal business analytics, often spread across dozens of suppliers and file-sharing links that nobody has audited in years, which makes them attractive targets.

Ransomware attacks on retailers keep rising. Expect more claims, some true and some not.

What happens next

Whether Clop’s claim against Sam’s Club holds up remains unclear. The case still shows how a single file-transfer flaw can put a large retailer on a leak site.

Retailers that patch quickly and keep exposed servers lean give groups like Clop less to steal.

Companies should also prepare a plan for responding to a leak-site claim, including how to verify it and what to tell customers.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.