Wawa customers’ information is for sale on dark web after data breach, company says
Hackers who broke into Wawa’s payment system and stole millions of credit card numbers have posted the data for sale on the dark web, according to the company and security experts.
The convenience store and gas station chain announced in December that malicious software had been running on its payment system from March through late April.
“Our information security team identified this malware on December 10, 2019, and by December 12, 2019, they had blocked and contained this malware. We also immediately initiated an investigation, notified law enforcement and payment card companies, and engaged a leading external forensics firm to support our response effort,” the company said in a statement.
Cyber security consulting firm Gemini Advisory said hackers began selling the Wawa customer data in late January on a dark web marketplace called The Joker’s Stash.
Gemini called the illicit digital market “one of the largest and most notorious dark web marketplaces for buying stolen payment card data.”
“Since the breach may have affected over 850 stores and potentially exposed 30 million sets of payment records, it ranks among the largest payment card breaches of 2019, and of all time,” Gemini said.
According to the cyber security site Krebs on Security, “This type of point-of-sale malware is capable of copying data stored on a credit or debit card’s magnetic stripe when those cards are swiped at compromised payment terminals, and that data can then be used to create counterfeit copies of the cards.”
The new chip-based cards are much harder to counterfeit, Krebs said, but banks and merchants in the United States have been slow to adopt the more secure, but also more expensive, credit card technology.
Wawa said in a statement that only credit card data was stolen, and “no debit card PIN numbers, credit card CVV2 numbers or other personal information were involved.“
