Wawa Customers’ Payment Data Is Being Offered For Sale Online After Massive Data Breach

Things just got worse for Wawa’s after the company’s recent massive data breach announced in December. 

Now, it appears that credit and debit card information belonging to the chain’s customers is being offered for sale online, according to Bloomberg. The data breach “ranks among the largest payment card breaches of 2019, and of all time” said fraud intelligence company Gemini Advisory. 

The data breach was announced back in December. Gemini has since found that data from cards used at Wawa stores is available for sale on “Joker’s Stash”, a notorious online marketplace where credit card information is often bought and sold. 

On Monday, data from 100,000 cards became available but Joker’s Stash claimed it had data on 30 million cards of Wawa customers. It’s likely that more data will be released in batches over the next 12 to 18 months, Gemini said. 

Wawa says it is “aware of reports of criminal attempts to sell come customer payment card information” and has alerted its payment card processor, payment card brands and card issuers in order to try and preemptively address the issue.

Wawa has also offered its customers a year of free credit monitoring, ostensibly so they can watch their credit decline in real time as their accounts are fraudulently used by 13 year olds in Russia to order toy drones and Facebook ads against whatever Democratic candidate is running against President Trump this year.  

The breach came as a result of malware running on Wawa payment processors from March until December of last year. “Potentially all” Wawa locations were compromised, according to CEO Chris Gheysens. 

Wawa said the breach was contained 2 days after it was found and that they remained confident that  “…only payment card information was involved, and that no debit card PIN numbers, credit card CVV2 numbers or other personal information were involved.”