Wawa wawa.com Wawa data breach: what happened and what to do
Wawa said malware on its payment systems captured card numbers, expiration dates and cardholder names at potentially all stores. It began after March 4, 2019, and was found on December 10, 2019. PINs and CVV2 codes were not included.
View all 13,115 breaches- Breach date
- 4 Mar 2019
- Made public
- 19 Dec 2019
- Data exposed
- Credit cards
- Last updated
What happened
Wawa, the convenience store and gas station chain, announced on December 19, 2019 that its security team had found malware on its payment processing servers on December 10, 2019. The company said it had contained the malware by December 12. The malware had been collecting card data since at least March 4, 2019, and Wawa said it was running on most store systems by about April 22, 2019.
Wawa operates more than 860 stores in six states. Its CEO, Chris Gheysens, said the malware potentially affected all locations, and announced it in a letter to customers.
What was exposed
According to Wawa's notice, the malware captured payment card numbers, expiration dates and cardholder names from cards used at its stores. Wawa said debit card PINs, credit card CVV2 numbers (the 3 or 4 digit code on the card) and ATM transactions were not affected. At the time of the notice the company said it knew of no unauthorized use of the data.
That mix is enough for card fraud. Criminals can use card numbers for fraud, especially at merchants that don't ask for the CVV2. It doesn't include your address or Social Security number, so identity theft is a much smaller risk here than card misuse.
What Wawa did
Wawa told customers to watch their card statements. The announcement did not give a number of affected cards, so any figure you see elsewhere is an estimate.
What to do if you were in it
- 1
Check your statements from March 2019 onward
Look for small charges you don't recognize. Thieves often test a stolen card with a few dollars before a bigger purchase.
- 2
Ask your bank to replace the card if you used it at Wawa
Call the number on the back of the card. A new card number makes the stolen one useless, and most banks do it for free.
- 3
Turn on transaction alerts
Set your card app to send a text or push notification for every purchase, so fraud shows up in minutes instead of at the end of the month.
- 4
Expect breach-themed phishing
Messages claiming to be from Wawa or your bank that ask you to confirm card details are scams. Go to the company's site or app yourself instead of tapping the link.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up. It can't remove data that already leaked, so the steps above matter most.
Frequently asked
Was I affected by the Wawa data breach?
Wawa said potentially every location was affected between March 4, 2019 and December 12, 2019, when the malware was contained. If you paid by card at a Wawa store in that period, assume your card details were exposed.
What information was exposed?
Card numbers, expiration dates and cardholder names. Wawa said PINs, CVV2 codes and ATM transactions were not included.
Do I need to change a password?
Not because of this breach. It involved card data from payment terminals, not account logins. Replace the card and watch your statements instead.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
