Wawa Reports Data Breach

December 19, 2019

Cars parked outside the Wawa on Trenton Road in Middletown.
Credit: Tom Sofield/LevittownNow.com

Nearly everyone in the Philadelphia region might need to get new credit and debit cards.

In a statement, Wawa said that a “data security incident” compromised all credit and debit card information used at potentially all of the family-owned chain locations between March 4 and last Thursday. The ATM cash machines were not impacted.

“I apologize deeply to all of you, our friends and neighbors, for this incident. You are my top priority and are critically important to all of the nearly 37,000 associates at Wawa. We take this special relationship with you and the protection of your information very seriously. I can assure you that throughout this process, everyone at Wawa has followed our longstanding values and has worked quickly and diligently to address this issue and inform our customers as quickly as possible,” Wawa CEO Chris Gheysens said.

The company’s security team found malware on Wawa payment processing servers early last week and worked to contain the threat. An investigation has found that malware infiltrated in-store payment processing systems at potentially all Wawa locations.

“Based on our investigation to date, this malware affected payment card information, including credit and debit card numbers, expiration dates, and cardholder names on payment cards used at potentially all Wawa in-store payment terminals and fuel dispensers beginning at different points in time after March 4, 2019 and ending on December 12, 2019. Most locations were affected as of April 22, 2019, however, some locations may not have been affected at all. No other personal information was accessed by this malware. Debit card PIN numbers, credit card CVV2 numbers (the three or four-digit security code printed on the card), other PIN numbers, and driver’s license information used to verify age-restricted purchases were not affected by this malware,” the Wawa statement said.

Wawa said they are working with law enforcement as they investigate the data breach.

Here is what Wawa said customers can do:

Review Your Payment Card Account Statements. We encourage you to remain vigilant by reviewing your payment card account statements. If you believe there is an unauthorized charge on your payment card, please notify the relevant payment card company by calling the number on the back of the card. Under federal law and card company rules, customers who notify their payment card company in a timely manner upon discovering fraudulent charges will not be responsible for those charges.
Register for Identity Protection Services. We have arranged with Experian to provide potentially impacted customers with one year of identity theft protection and credit monitoring at no charge to you. Information about these services is available at www.wawa.com/alerts/data-security or call toll-free to 1-844-386-9559.
Order a Credit Report. If you enroll in the Experian service (at the phone number above) we are offering, you will have access to activity on your credit report. In addition, if you are a U.S. resident, you are entitled under U.S. law to one free credit report annually from each of the three nationwide consumer reporting agencies. To order your free credit report, visit www.annualcreditreport.com or call toll-free at 1-877-322-8228.