Wawa customers’ credit card information has been compromised for months, company says
Wawa says it is investigating a data breach that may have affected all of its stores.
The company’s information security team found malware on payment processing servers on Dec. 10, Wawa CEO Chris Gheysens said in an announcement on Thursday.
The malware was contained by Dec. 12, the announcement said, but affected customers’ payment information at “different points in time after March 4” until it was contained.
Information affected includes credit and debit card numbers, expiration dates and cardholder names, the company’s investigation found.
Cards used in-store and at gas pumps at “potentially all” of the convenience store’s locations could have been affected by the breach, the announcement says.
As of April 22, most locations were affected, the announcement says, but it’s possible some were not.
Customers won’t have to pay for any fraudulent purchases that were made on their cards related to the breach, the announcement says.
“At this time, we believe this malware no longer poses a risk to Wawa customers using payment cards at Wawa, and this malware never posed a risk to our ATM cash machines,” the announcement said.
PIN numbers, CVV2 numbers on credit cards and driver’s license information were not impacted, according to the announcement, and Wawa customers who didn’t use cards between March 4 and Dec. 12 were not impacted.
But those who did should review their payment statements, Gheysens says. He also recommends registering for identity protection services and ordering a credit report.
Customers who may have been impacted can enroll in one year of identify theft protection through Experian for free, the announcement says. Information is available at www.wawa.com/alerts/data-security or by calling 1-844-386-9559.
Those who enroll in the service will have access to activity on their credit reports, the announcement says.
The company is working with law enforcement and supporting a criminal investigation, the announcement says.
Customers can also call a toll-free call center at 1-844-386-9559 with questions, the announcement says.
“I apologize deeply to all of you, our friends and neighbors, for this incident,” Gheysens said in the announcement. “You are my top priority and are critically important to all of the nearly 37,000 associates at Wawa. We take this special relationship with you and the protection of your information very seriously.”
This story was originally published December 19, 2019 at 5:52 PM.
