Personal Data of 1.3 Million Shoppers Exposed by Walmart Partner

Personal Data of 1.3 Million Shoppers Exposed by Walmart Partner

According to cybersecurity firm Kromtech, who found it stored in a publicly accessible Amazon S3 bucket.

  • By Sydny Shepard
  • Mar 20, 2018

The personal data of over 1.3 million people across the United States and Canada were publicly exposed online by Walmart's jewelry partner, according to cybersecurity firm Kromtech, who found it stored in a publicly accessible Amazon S3 bucket.

Researchers first assumed the Amazon web server belonged to Walmart, since the storage bucket was named, "walmartsql." However, they later uncovered the databased actually belonged to a Chicago-based firm called MBM Company Inc., which primarily operates under the name Limogés Jewelry.

According to Kromtech, the database was left exposed online since Jan. 13 2018, and included names, addresses, zip codes, phone numbers, email addresses, and plaintext passwords for 1,314,193 people.

It also contained numerous records for retailers other than Walmart. Over the years, Limogés Jewelry has done business with retailers such as Amazon, Overstock, Sears, Kmart and Target, among others.

Kromtech researchers also found internal MBM mailing lists, payment details, promo codes, item orders, as well as encrypted credit card details. The records exposed dated as far back as 2000 and extended to early 2018. Researchers believe this may have been MBM Company's main customer database.

“In more than one case, the sensitive data has been exposed by a partner or third party. Organizations need to not only take steps to secure sensitive data in their possession, but also as it’s handed off to these partners," Tim Erlin, VP, product management and strategy at cybersecurity firm Tripwire said. "Protecting customer data from this type of exposure doesn’t require amazing new security tools. Ensuring that systems are secure when deployed and monitoring them for changes is part of doing the basics right. Those security basics apply as much to the cloud as the data center.”  

Fortunately, shortly after the exposed data was found the publicly accessible database was "quietly" secured by Walmart. Kromtech found no evidence of ransom notes, but that doesn't mean no one accessed the data.

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

Featured

  • Report: 47 Percent of Security Service Providers Are Not Yet Using AI or Automation Tools

    Trackforce, a provider of security workforce management platforms, today announced the launch of its 2025 Physical Security Operations Benchmark Report, an industry-first study that benchmarks both private security service providers and corporate security teams side by side. Based on a survey of over 300 security professionals across the globe, the report provides a comprehensive look at the state of physical security operations. Read Now

    • Guard Services

  • Identity Governance at the Crossroads of Complexity and Scale

    Modern enterprises are grappling with an increasing number of identities, both human and machine, across an ever-growing number of systems. They must also deal with increased operational demands, including faster onboarding, more scalable models, and tighter security enforcement. Navigating these ever-growing challenges with speed and accuracy requires a new approach to identity governance that is built for the future enterprise. Read Now

  • Eagle Eye Networks Launches AI Camera Gun Detection

    Eagle Eye Networks, a provider of cloud video surveillance, recently introduced Eagle Eye Gun Detection, a new layer of protection for schools and businesses that works with existing security cameras and infrastructure. Eagle Eye Networks is the first to build gun detection into its platform. Read Now

  • Report: AI is Supercharging Old-School Cybercriminal Tactics

    AI isn’t just transforming how we work. It’s reshaping how cybercriminals attack, with threat actors exploiting AI to mass produce malicious code loaders, steal browser credentials and accelerate cloud attacks, according to a new report from Elastic. Read Now

  • Pragmatism, Productivity, and the Push for Accountability in 2025-2026

    Every year, the security industry debates whether artificial intelligence is a disruption, an enabler, or a distraction. By 2025, that conversation matured, where AI became a working dimension in physical identity and access management (PIAM) programs. Observations from 2025 highlight this turning point in AI’s role in access control and define how security leaders are being distinguished based on how they apply it. Read Now

Most   Popular

New Products

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises.