Wawa controversies

Company response

• Remediation — Wawa

  In response, Wawa is offering free credit monitoring and identity theft prevention.

• Apology — Wawa

  From there, Gheysens went right to the facts: hard data, what, where and when.

Source excerpt

• From there, Gheysens went right to the facts: hard data, what, where and when. “Our security team discovered malware on Wawa payment processing servers on December 10, 2019, and contained it by December 12, 2019. The malware affected customer payment card information used at potentially all Wawa locations beginning after March 4, 2019.”

• Our security team discovered malware on Wawa payment processing servers on December 10, 2019, and contained it by December 12, 2019.

• In response, Wawa is offering free credit monitoring and identity theft prevention.

Company response

• Investigation — Wawa

  The company hired an outside forensics firm to investigate and reported the attack to law enforcement.

• Remediation — Wawa

  Wawa said it contained and blocked the malware after discovering it.

• Refund or compensation — Wawa

  It is offering customers one year of identity theft protection and credit monitoring at no charge through Experian IdentityWorks.

Source excerpt

• The breach, discovered and patched last month, was the result of a malware attack.

• The company hired an outside forensics firm to investigate and reported the attack to law enforcement.

• It is offering customers one year of identity theft protection and credit monitoring at no charge through Experian IdentityWorks.

Source excerpt

• The lawsuit claims Dubose suffered injuries to her mouth and teeth, causing permanent damage. It alleges Wawa was negligent for providing a product that was unsafe and dangerous.

• Nikkia Dubose, 28, of Bridgeton, filed suit on Wednesday in Superior Court in Cumberland County.

• A New Jersey woman has filed a lawsuit against Wawa claiming a screw in her fountain drink caused permanent injuries to her mouth and teeth.

Source excerpt

• The settlement, which requires court approval, resolves claims that the company improperly limited the rights of former employees to stay invested in the stock plan until they reached age 68 and that it undervalued the stock it purchased from those accounts when it forced people out of the plan

• Wawa is paying $21.6 million to settle a 2018 class-action lawsuit involving the company’s employee stock option plan, according to a court filing Thursday.

• The new $21.6 million settlement will compensate about 10,000 former employees by about $500 per share of Wawa stock they owned, the proposed order read.

Company response

• Clarification — Wawa

  Wawa on Tuesday had issued a statement saying that it was aware of the “reports of criminal attempts” to sell card data online and was working with federal agencies to prevent the same. It also urged customers to notify their card company of any fraudulent charges.

Source excerpt

• In a breach titled titled “BIGBADABOOM-III,” Joker’s Stash, one of the largest carding fraud forums on the dark web advertised that it had credit and debit card details of more than 30 million American cardholders and over one million foreign cardholders on Monday.

• Gemini Advisory published a report detailing the data breach that identified the source of the breach as Wawa, an east coast-based convenience store and gas station chain.

• Wawa had admitted to being hacked back in December 2019. Hackers had planted malware on Wawa’s point of sale systems, reported ZDNet. The malware enabled hackers to collect credit and debit card details of Wawa customers who had used the card at their convenience store or gas station.

Source excerpt

• The Philadelphia Inquirer reported Friday that at least six lawsuits seeking class-action status have been filed in federal court in Philadelphia.

• Wawa Inc. discovered malware on its payment processing servers this month before stopping the breach Dec. 12, the company has said.

• “The data breach was the inevitable result of Wawa’s inadequate data security measures and cavalier approach to data security,” said one suit, filed by the law firm Chimicles Schwartz Kriner & Donaldson-Smith, of Haverford.

Company response

• Investigation — Wawa

  immediately engaged a leading external forensics firm and notified law enforcement

Source excerpt

• The Pennsylvania-based chain says it discovered malware on its payment processing servers last week. It believes the software was collecting card numbers, customer names and other data as early as March 4.

• In a letter, Wawa CEO Chris Gheysens said the chain's information security team "discovered malware on Wawa payment processing servers" on Dec. 10, "contained" the malware by Dec. 12 and "immediately engaged a leading external forensics firm and notified law enforcement."

• Wawa customers who paid with credit or debit cards in the last nine months may have had their card information compromised, the convenience store chain announced Thursday.

Company response

• Apology — Wawa

  "I apologize deeply to all of you, our friends and neighbors, for this incident," Gheysens said.

• Remediation — Wawa

  The company has committed to providing identity theft protection and credit monitoring for one year through Experian to those who may be affected by the Wawa data breach.

Source excerpt

• Investigators determined customer information may have been exposed from March 4 to Dec. 12 from payment cards used at cashier terminals and fuel pumps.

• "I apologize deeply to all of you, our friends and neighbors, for this incident," Gheysens said.

• Wawa found malware on its payment processing systems Dec. 10, according to a statement the company issued Thursday.