A data security breach may have affected customers who used credit and debit cards at “potentially all” Wawa convenience stores in Virginia and other East Coast states during the past nine months, the company said Thursday.
The retailer’s information security team discovered malware on Wawa payment processing servers on Dec. 10, Wawa’s CEO Chris Gheysens said in an open letter to customers posted on the chain’s website. The breach was contained by Dec. 12, he said.
“This malware affected customer payment card information used at potentially all Wawa locations beginning at different points in time after March 4, 2019, and until it was contained,” Gheysens said.
“At this time, we believe this malware no longer poses a risk to Wawa customers using payment cards at Wawa, and this malware never posed a risk to our ATM cash machines,” he said.
Based in Pennsylvania, Wawa has about 850 retail stores in Pennsylvania, Virginia, New Jersey, Delaware, Maryland, Florida, and Washington, D.C.
The breach affected credit and debit card numbers, expiration dates, and cardholder names on payment cards used at Wawa in-store payment terminals and at fuel pumps. Most of the store locations were affected as of April 22, but the company said some locations may not have been affected at all.
The company said no other personal information was accessed, including debit card personal identification numbers, credit card security codes or driver’s license information used to verify age-restricted purchases.
Wawa said it is working with law enforcement agencies to support a criminal investigation of the data breach.
The company recommended that customers review their payment card account statements for any fraudulent charges and register for identity protection services.
Wawa said it has arranged with Experian to provide potentially affected customers with one year of identity theft protection and credit monitoring at no charge. The company also set up a toll-free phone line for customers with questions at (844) 386-9559.
“I apologize deeply to all of you, our friends and neighbors, for this incident,” Gheysens said in the letter to customers. “You are my top priority and are critically important to all of the nearly 37,000 associates at Wawa.”