Sam’s Club, the Walmart-owned warehouse supermarket chain, is actively investigating claims of a security breach after the Clop ransomware gang added the retailer to its dark web leak site on Friday.

“We are aware of reports regarding a potential security incident and are actively investigating the matter,” a Sam’s Club spokesperson confirmed. “Protecting the privacy and security of our members’ information is a top priority at Sam’s Club.”

The Arkansas-based wholesaler, which operates over 600 warehouse clubs across the United States and Puerto Rico, with nearly 200 additional locations in Mexico and China, employs more than 2.3 million people and reported $84.3 billion in revenue for fiscal year 2023.

While Clop has not yet published evidence of the breach, the ransomware group claimed on its leak site that Sam’s Club “doesn’t care about its customers, it ignored their security.”

This development follows Clop’s January extortion campaign targeting dozens of organizations through a zero-day vulnerability (CVE-2024-50623) in Cleo secure file transfer software. Cleo’s products are reportedly used by over 4,000 organizations worldwide. One victim, Western Alliance Bank, recently notified nearly 22,000 customers that their personal information was stolen during these attacks.

The Clop ransomware gang has previously conducted similar data theft campaigns exploiting vulnerabilities in Accellion FTA, MOVEit Transfer, and GoAnywhere MFT.

This isn’t Sam’s Club’s first security incident. In October 2020, the company notified customers of account compromises from credential stuffing attacks, which prompted password resets across affected SamsClub.com accounts.