Wawa announced Tuesday that it became aware of reports of criminal attempts to sell some customer payment card information that was possibly involved in the data breach incident reported in December.
The company said late last year that it began notifying people who have potentially been impacted by a data breach that affected customer payment card information used at potentially all store locations during a specific timeframe.
Wawa’s information security team discovered malware on Wawa payment processing servers on December 10, 2019, and contained it by December 12, 2019. After discovering this malware, Wawa immediately engaged a leading external forensics firm and notified law enforcement.
Based on Wawa’s forensic investigation, it now understands that this malware began running at different points in time after March 4, 2019.
Wawa says it has alerted its payment card processor, payment card brands and card issuers to heighten fraud-monitoring activities to help further protect any customer information. It is continuing to work closely with federal law enforcement to determine the scope of the disclosure of Wawa-specific customer payment card data.
The company is encouraging customers to review charges on their payment card statements and to promptly report any unauthorized use to the bank or financial institution that issued the card by calling the number on the back of it.
Under federal law and card company rules, customers who notify their payment card issuer in a timely manner of fraudulent charges will not be responsible for those charges. In the unlikely event any individual customer who has promptly notified their card issuer of fraudulent charges related to this incident is not reimbursed, Wawa will work with them to reimburse them for those charges.
The company says it “remains confident” that only payment card information was involved and that no debit card PINs, credit card CVV2 numbers or other personal information were involved.
The incident didn’t affect ATM transactions.
Customers can sign up for the credit monitoring and identity theft protection Wawa is offering for free by visiting their website or by contacting their dedicated toll-free call center at 1-844-386-9559.
